Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bucketsquatting is finally dead

onecloudplease.com

Post reply on HN
Print view View original

21–30 of 187 posts

Re: Bucketsquatting is finally dead

#21

Post by iann0036 »

vhab wrote: post #9

> For Azure Blob Storage, storage accounts are scoped with an account name and container name, so this is far less of a concern. The author probably misunderstood what "account name" is in Azure Storage's context, as it's pretty much the equivalent of S3's bucket name, and is definitely still a large concern. A single pool of unique names for storage accounts across all customers has been a very large source of frust…

Author here. Thanks for the call out! I've updated the article with attribution.

Re: Bucketsquatting is finally dead

#22

Post by Galanwe »

INTPenis wrote: post #12

I started treating long random bucketnames as secrets years ago. Ever since I noticed hackers were discovering buckets online with secrets and healthcare info. This is where IaC shines.

This is all good and we'll on the IaC side,yes. But at the end of the day, buckets are also user facing resources, and nobody likes random directory / bucket names.

Re: Bucketsquatting is finally dead

#23

Post by iknownothow »

Aardwolf wrote: post #10

Why all that stuff with namespaces when they could just not allow name reuse?

Potential reasons I can think of for why they don't disallow name reuse:

a) AWS will need to maintain a database of all historical bucket names to know what to disallow. This is hard per region and even harder globally. Its easier to know what is currently in use rather know what has been used historically.

b) Even if they maintained a database of all historically used bucket names, then the latency to query if something exists in it may be large enough to be annoying during bucket creation process. Knowing AWS, they'll charge you for every 1000 requests for "checking if bucket name exists" :p

c) AWS builds many of its own services on S3 (as indicated in the article) and I can imagine there may be many of their internal services that just rely on existing behaviour i.e. allowing for re-creating the same bucket name.

Re: Bucketsquatting is finally dead

#24

Post by ramon156 »

iknownothow wrote: post #15
ChrisMarshallNY wrote: post #3

[flagged]

I'd ask politely to refrain from such comments :) This is not me criticising you. I totally understand the urge to say it. We're all thinking the thing you're thinking of. It takes effort not to give into it ;) The reason I personally would refrain from making such comments is that they have the potential to end up as highest ranked comment. That would be a shame. Topic of S3 bucketsquatting is rather important and v…

You did not really give a reason to refrain from making a joke. Don't take yourself too serious

Re: Bucketsquatting is finally dead

#25

Post by iknownothow »

Thank you author Ian Mckay! This is one of those good hygiene conventions that save time by not having to think/worry each time buckets are named. As pointed out in the article, AWS seems to have made this part of their official naming conventions [1].

I'm excited for IaC code libraries like Terraform to incorporate this as their default behavior soon! The default behavior of Terraform and co is already to add a random hash suffix to the end of the bucket name to prevent such errors. This becoming standard practice in itself has saved me days in not having to convince others to use such strategies prior to automation.

[1] https://aws.amazon.com/blogs/aws/introducing-account-regiona...

Re: Bucketsquatting is finally dead

#28

Post by aduwah »

alemwjsl wrote: post #27

I take it advertising your account id isn't a security risk?

It is not hygienic, but with only the account-id you are fine. In the IAM rules the attacker can always just use a * on their end, so it does not make a difference. You have to be conscious to set proper rules for your (owner) end tho.

Re: Bucketsquatting is finally dead

#29

Post by dwedge »

iknownothow wrote: post #23
Aardwolf wrote: post #10

Why all that stuff with namespaces when they could just not allow name reuse?

Potential reasons I can think of for why they don't disallow name reuse: a) AWS will need to maintain a database of all historical bucket names to know what to disallow. This is hard per region and even harder globally. Its easier to know what is currently in use rather know what has been used historically. b) Even if they maintained a database of all historically used bucket names, then the latency to query if somet…

I can't accept a) or b). They already need to keep a database of all existing bucket names globally, and they already need to check this on bucket creation. Adding a flag on deleted doesn't seem like a big loss.

As for c), I assume it's not just AWS relying on this behaviour. https://xkcd.com/1172/

Re: Bucketsquatting is finally dead

#30

Post by josephg »

Sometimes I wonder if package names, bucket names, github account names and so on should use a naming scheme like discord. Eg, @sometag-xxxx where xxxx is a random 4 digit code. Its sort of a middleground between UUID account names and completely human generated names.

This approach goes a long way toward democratizing the name space, since nobody can "own" the tag prefix. (10000 people can all share it). This can also be used to prevent squatting and reuse attacks - just burn the full account name if the corresponding user account is ever shut down. And it prevents early users from being able to snap up all the good names.

Post reply on HN