Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So this guy is now S3. All of S3

chaos.social

Post reply on HN
Print view View original

311–320 of 522 posts

Re: So this guy is now S3. All of S3

#311

Post by gkbrk »

steveklabnik wrote: post #149
efitz wrote: post #139

If you want to prove domain ownership, you have to do it at the domain level. The ability to serve a file “www.example.com” in no way demonstrates ownership of “example.com”; it demonstrates that you control www.example.com. If you want to prove ownership of a second level domain you must do it through a record in DNS, or through demonstrating control of something that is publicly known to control the domain such as…

As said multiple times in this thread, the primary way of identifying yourself in this protocol is a TXT record in DNS.

The "primary" way doesn't really matter if a user checks their app and sees that it was verified.

Unless the UI makes it clear it was verified with "non-primary" methods so users can be cautious, any method of verification is essentially "primary" from the user POV.

Re: So this guy is now S3. All of S3

#312

Post by brookst »

givemeethekeys wrote: post #76
sidmitra wrote: post #3

For those not getting the context(like me), this seems to be about the Bluesky Social( https://bsky.app/ ), a twitter alternative.

Sometimes it feels like companies fund weak competitors to discourage / drown out competition.

There's enough imperfection in the world that no conspiracy is required.

Re: So this guy is now S3. All of S3

#313

Post by easrng »

roblabla wrote: post #195
ehPReth wrote: post #185

Earlier quoted context omitted.

I think crossdomain.xml died with Flash but I could be wrong, does anyone know?

None of the standardized web technologies use crossdomain.xml, but I think Acrobat Reader still uses it for... stuff. And acrobat still has a browser plugin, so I guess it's still a potential vector for abuse.

But no browsers support 3rd-party plugins anymore. (I think the Chromium PDF viewer might be a plugin internally though?)

Re: So this guy is now S3. All of S3

#314

Post by airstrike »

brookst wrote: post #312
givemeethekeys wrote: post #76

Earlier quoted context omitted.

Sometimes it feels like companies fund weak competitors to discourage / drown out competition.

There's enough imperfection in the world that no conspiracy is required.

"Never attribute to malice that which can be explained by incompetence"?

Re: So this guy is now S3. All of S3

#316

Post by wbl »

philsnow wrote: post #261
mikepurvis wrote: post #176

Earlier quoted context omitted.

And given that bucket names are a giant shared namespace, there's absolutely an incentive toward lots of prefixing to help ensure you get the ones you want.

> ensure you get the ones you want Also to try to avoid having to special-case any logic in terraform etc. Say you're working on a family of sites for tradespeople like plumber.io, electrician.io, carpenter.io, etc. A fair number of people from India have "occupational surnames" like Miller, Contractor, Builder, Sheriff, etc. Suddenly one Mr. Dev Contractor registers a bucket "contractor-dev" and you have to special-…

Yanks too. What do you think Smith, Miller, Farmer, etc. are?

Re: So this guy is now S3. All of S3

#317

Post by nailer »

megablast wrote: post #283
dylan604 wrote: post #282

Earlier quoted context omitted.

Microsoft funded Apple to keep another OS vendor alive, so it's not about discouragement. It's probably a lot cheaper to fund a competitor than paying the gov't and getting tagged as a recognized monopoly

Not true at all. https://www.zdnet.com/article/stop-the-lies-the-day-that-mic...

Quick summary: code from Apple’s QuickTime for Windows found its way into Microsoft Video for Windows. The Microsoft investment was the result of Apple winning a lawsuit.

Re: So this guy is now S3. All of S3

#318

Post by steveklabnik »

gkbrk wrote: post #311
steveklabnik wrote: post #149

Earlier quoted context omitted.

As said multiple times in this thread, the primary way of identifying yourself in this protocol is a TXT record in DNS.

The "primary" way doesn't really matter if a user checks their app and sees that it was verified. Unless the UI makes it clear it was verified with "non-primary" methods so users can be cautious, any method of verification is essentially "primary" from the user POV.

Yes. It is a problem that this method has issues. They’ll be fixed. My point is, they did not ignore that case, they focused on it! This is just a bug in an additional method.

Re: So this guy is now S3. All of S3

#319

Post by vlovich123 »

vlovich123 wrote: post #298
technion wrote: post #290

Earlier quoted context omitted.

A while back I made one with a name like "postgresbackups" and was floored to realise later it was a global name.

To this day I don't know why it's a global name. For R2 we looked at this, saw the massive annoyance picking bucket names, and made it scoped to your account. CNAME records are orthogonal and can be set up to point to your bucket with a few button clicks.

Oh yeah, also we're more secure by default. Granted S3 was built a long time ago maybe when security was an afterthought and such mistakes are harder to correct now.

Other things I think we do better on:

* The account is the top-level thing we publish a cert for. Without knowing the bucket name you can't really do anything. With S3's global namespace, each bucket has a cert published which makes all buckets discovered as soon as they're created.

* Not default open to the world

* The R2-managed public bucket cname is shared and the URL for the bucket is random (i.e. just a UUID). Additionally, if you delete and recreate the bucket with the same name IIRC that random UUID is changed.

* We have a lot of sensible extensions like automatically creating a bucket on upload (granted not possible for S3 since buckets are global), setting per-object TTLs, handling unicode more gracefully (I think normalizing the key name is a saner choice with fewer foot guns even if there's some potential compatibility issues when you try to synchronize from a filesystem where you have two files with different forms but same normalized), etc etc etc.

Re: So this guy is now S3. All of S3

#320

Post by linuxdude314 »

YtvwlD wrote: post #38
steveklabnik wrote: post #33

Earlier quoted context omitted.

This is a private beta. Nobody is suggesting that any of this be used for anything serious just yet. Development happens out in the open, you can go find out what else they've missed by doing the work, or by waiting until others you trust have done so. I myself have had an account for like a month now, but only started really using it a week ago, because that calculus changed for me, personally. Like, it's not even p…

Okay, yes, but this indicates that they didn't read the ActivityPub before developing their own new shiny protocol.

Paul has lots of experience designing protocols. He designed SSB. ActivityPub does a lot of things wrong from first principals.

The whole point was to start from scratch.

Post reply on HN