Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hundreds of exposed Amazon cloud backups found leaking sensitive data

techcrunch.com

Post reply on HN
Print view View original

61–70 of 73 posts

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#61

Post by new_guy »

alexanderdmitri wrote: post #58
1000units wrote: post #50

Earlier quoted context omitted.

There's only one known remedy and it costs 15 cents, so that mask is precious. It's a special gift to be able to see these things clearly, but it comes at the cost of close acquaintance, and you'll always be more watchful than the innocent of mind. It's grimly amusing how common and relevant psychological aberrance is relative to the average person's perception of it (cf. downvotes). It's tiring and unpleasant to exa…

This is a rather cryptic comment. Are you saying there's some sort of group or club where you pay 15 cents for a mask and then put it on to get well-acquainted to psycologically aberrant individuals from a comfortable distance before they go prison?

It's not cryptic, just completely OT in a tech forum. He means the price of a bullet.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#62

Post by 1000units »

alexanderdmitri wrote: post #58
1000units wrote: post #50

Earlier quoted context omitted.

There's only one known remedy and it costs 15 cents, so that mask is precious. It's a special gift to be able to see these things clearly, but it comes at the cost of close acquaintance, and you'll always be more watchful than the innocent of mind. It's grimly amusing how common and relevant psychological aberrance is relative to the average person's perception of it (cf. downvotes). It's tiring and unpleasant to exa…

This is a rather cryptic comment. Are you saying there's some sort of group or club where you pay 15 cents for a mask and then put it on to get well-acquainted to psycologically aberrant individuals from a comfortable distance before they go prison?

Fifteen cents is roughly the cost of a small informational pamphlet (likely more if printed with color and laminated but I have taken some artistic liberty in my previous comment), and prison is just one solution to a wider class of social impairments of which sociopathy is just one instance. Other instances of solutions share the quality of being unpleasant but necessary things any civilized society devotes energy to by learned necessity and include a functioning constitution, military, legislature, courts, police, and more. I thought this was clear but on rereading I see maybe I have failed; thanks for asking.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#63

Post by 1000units »

new_guy wrote: post #61
alexanderdmitri wrote: post #58

Earlier quoted context omitted.

This is a rather cryptic comment. Are you saying there's some sort of group or club where you pay 15 cents for a mask and then put it on to get well-acquainted to psycologically aberrant individuals from a comfortable distance before they go prison?

It's not cryptic, just completely OT in a tech forum. He means the price of a bullet.

Not so! A .22LR cartridge is less than three cents when purchased in any reasonable quantity.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#64

Post by jackcodes »

thegeomaster wrote: post #53
atoav wrote: post #47

Earlier quoted context omitted.

As much as I dislike the typical suit wearer, the industry as a whole would be much better if IT-people wouldn’t blame everything on them and just tell them you won’t do it. If you are a welder and you boss wants you to weld a gas tank that hasn’t been emptied you tell him that he has no idea what the thing he asks for means, explain why and wait till the gas tank is emptied and everything is checked. I worked as a C…

>If engineers would build bridges like we in IT operate, we would have many collapses a day. Maybe a bit offtopic at this point, but whay you said reminded me of this: https://www.stilldrinking.org/programming-sucks

I really enjoyed this, thanks. Do you have any other similar ones, or tangentially related bookmarks you could share?

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#65

Post by nurettin »

atoav wrote: post #47
lowdose wrote: post #22

Earlier quoted context omitted.

The guy that produces that last line definitely wears a suit.

As much as I dislike the typical suit wearer, the industry as a whole would be much better if IT-people wouldn’t blame everything on them and just tell them you won’t do it. If you are a welder and you boss wants you to weld a gas tank that hasn’t been emptied you tell him that he has no idea what the thing he asks for means, explain why and wait till the gas tank is emptied and everything is checked. I worked as a C…

All of these anecdotes have something in common. That the person who is asked to do something is informed about proper procedures. That is uncommon in IT, and especially in companies where proper procedure is too costly and not worth pursuing.

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#66

Post by atoav »

nurettin wrote: post #65
atoav wrote: post #47

Earlier quoted context omitted.

As much as I dislike the typical suit wearer, the industry as a whole would be much better if IT-people wouldn’t blame everything on them and just tell them you won’t do it. If you are a welder and you boss wants you to weld a gas tank that hasn’t been emptied you tell him that he has no idea what the thing he asks for means, explain why and wait till the gas tank is emptied and everything is checked. I worked as a C…

All of these anecdotes have something in common. That the person who is asked to do something is informed about proper procedures. That is uncommon in IT, and especially in companies where proper procedure is too costly and not worth pursuing.

It is still a communications problem. They want you to do the minimum. If I as a camera person do the real minimum the director will be pleased on set but they will get a heart attack in the editing room.

It easier to give in, take short cuts and produce garbage than explaining them under extreme stress that everything faster will result in nothing.

In my eyes it is comparable and I worked in both industries. The difference is, that as a DOP in film your name will be associated with the mess on the screen, while in IT the link is not that clear. This makes the difference.

And unless your director has a monitor (which they sometimes don’t) they cannot tell at all what you are doing. They wouldn’t even realize if you didn’t even switch the camera on.

I know that film or engineering is more

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#67

Post by d2mw »

dragonwriter wrote: post #17
d2mw wrote: post #2

Public EBS snapshots are great, and thankfully a design other clouds didn't copy. I've found all kinds of stuff in there, including a 900GB Oracle backup of a publicly traded manufacturer's accounting system. It doesn't require much imagination to understand how this kind of data could be profited from, given relatively low effort It seems unlikely a lot of people didn't already know about this, it's hard to miss eve…

> and it's also quite surprising AWS have yet to correct the design. 90% chance it is mostly a UI problem -- there are no warning labels around snapshotting in the EC2 UI Snapshots are private by default, you have to actively make them public (impossible if encrypted) or share them (which also requires sharing the associated keys if encrypted.) Now, AWS hasn't wrapped the extra layer of “by default, reject any settin…

What I mean is https://i.ibb.co/P6N35qv/Screenshot-from-2019-08-10-10-27-25... does not make it clear whatsoever that 'public' really means public. Before we get into blaming the customer, there should be a bright red warning label in that dialog. Consider that English may not be the first language of many users reaching that screen

I think they have it for some stuff elsewhere, but it doesn't seem unreasonable to make public snapshots a per-account permission that defaults to disabled, and requires an interactive UI checkbox to enable. Out of the millions of AWS accounts, public snapshots are legitimately useful to maybe 1000 tops

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#68

Post by based2 »

joncrane wrote: post #5

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…

to synchronize backups to the onprem datacentre. https://angus.readthedocs.io/en/2014/amazon/using-ebs-snapsh...

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#69

Post by Bombthecat »

dboreham wrote: post #11
joncrane wrote: post #5

I've been working almost exclusively in the AWS space for about 10 years now. Clients anywhere from tiny little three-person consultancies to Fortune 100. Commercial, govcloud, dozens of clients. Never once have I ever found a use case for making public EBS snapshots. Who on Earth is thinking that it is a good idea to take an EBS snapshot and make it public? Note, several of those engagements did involve multiple acc…

Laziness in attempting to share data with someone in another org? "Nope, can't access it" ... "Nope, still can't access it"... "My manager is harassing me to get access now"... "Look, just make it public then change it back after I get it copied"...

Too real...

Re: Hundreds of exposed Amazon cloud backups found leaking sensitive data

#70

Post by ygra »

jackcodes wrote: post #64
thegeomaster wrote: post #53

Earlier quoted context omitted.

>If engineers would build bridges like we in IT operate, we would have many collapses a day. Maybe a bit offtopic at this point, but whay you said reminded me of this: https://www.stilldrinking.org/programming-sucks

I really enjoyed this, thanks. Do you have any other similar ones, or tangentially related bookmarks you could share?

It reminded me a bit of James Mickens’ writings. Not quite as weird and insane as him, but close.
Post reply on HN