31–38 of 38 posts
AWS S3 scares the shit out of me. The company I worked for misconfiguration one of the buckets and allowed uploads. A couple of months later there was a bill for $15k. Since apparently some spammers were using our service. Which is OK for a company but I would not want to use it as a private individual.
AWS S3 scares the shit out of me. The company I worked for misconfiguration one of the buckets and allowed uploads. A couple of months later there was a bill for $15k. Since apparently some spammers were using our service. Which is OK for a company but I would not want to use it as a private individual.
Not using the budget reporting feature is the bigger issue here IMO and just highlights that the organization was poorly managed.
Earlier quoted context omitted.
Not using the budget reporting feature is the bigger issue here IMO and just highlights that the organization was poorly managed.
Wow you can figure all of that out from a single sentence?
Earlier quoted context omitted.
Likely law enforcement found out about it being used to distribute illegal content and then applied pressure. Companies don’t have a strong history of successfully resisting that pressure.
law enforcement is so bass-ackward on privacy/security tools Of course, if a hammer is for sale, some will use it to build houses and a subset will use it to hurt people. Just because something can possibly be bad doesn't mean we shouldn't have it
I’m all for privacy, but I wouldn’t support my tool being used predominantly for criminal activity, no matter how good I feel about it as a security/privacy tool.
Earlier quoted context omitted.
If this is something you’re interested in it can be reimplemented on CloudFlare workers super easily using the awssdk for s3 (R2) and with D1 as the DB.
Yes, but would be great if someone made it and is open source. Would be cool little side project, no doubt.
Earlier quoted context omitted.
FF Send already had encryption -- IIRC, Mozilla shut it down because it was being abused.
Abused in what way? Content? How would they know, if it was encrypted. Or volume?
It's not uncommon for forums to share links to resources, along with the password to decrypt them. And FF Send had a nice API for uploading material. It'd be an afternoon coding project to build a tool to re-upload material every 7 days, and update forum posts automatically so it could be available long term, beyond the max expiration time for anonymous uploads.
Earlier quoted context omitted.
Wow you can figure all of that out from a single sentence?
Yes, because not only was the projected cost not monitored, neither were changes to bucket security. They have entire suites of tools to monitor all of this stuff that is easily accessible.
Another question: does any mistake in configuration signal a mismanaged company to you?
Earlier quoted context omitted.
Yes, because not only was the projected cost not monitored, neither were changes to bucket security. They have entire suites of tools to monitor all of this stuff that is easily accessible.
This was back in 2006/2007 and the very first foray of that company into using cloud computing. Those tools you mentioned largely did not exist. And the UI's where a lot more confusing and less clear than they are now. Another question: does any mistake in configuration signal a mismanaged company to you?
And no, mistakes do not necessarily signal a mismanaged company to me, but not knowing what you will be charged from one day to the next certainly smells like a bad policy to me.