Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS CodeArtifact: A fully managed software artifact repository service

aws.amazon.com

Post reply on HN
Print view View original

81–90 of 92 posts

Re: AWS CodeArtifact: A fully managed software artifact repository service

#81

Post by Turbots »

hn_throwaway_99 wrote: post #70
ludjer wrote: post #61

Earlier quoted context omitted.

Considering the price of Nexus and Artifactory this is way cheaper for a SAAS offering with SLA's. I imagine Artifactory is really going to have to up their product offering or at least lower their entry prices.

Github already released their package repo last year (and have since purchased NPM). If anything I imagine that had Artifactory pretty scared vs. this. If your company already uses GitHub it's a hard sell to say why you'd need something like Artifactory over the Github package repo.

And since I've been trying GitHub Actions, I don't know why you would need artifactory, nexus or this aws service anymore. Github offers private repositories, releases, project pages, cicd through actions and Microsoft is offering plenty of deployment options on Azure with AKS or plain Azure Compute

Re: AWS CodeArtifact: A fully managed software artifact repository service

#83

Post by mcrute »

scarface74 wrote: post #31

No C#/Nuget support? Really?

The back-end is largely package type agnostic and the package manager front-ends are pluggable. I'd look for AWS to expand package manager support in the near future. Nuget was on the list along with a few other popular package managers. There's a whole lot of functionality in the platform they didn't yet expose or have finished for the launch, I'd keep an eye on this as they move forward.

Source: I lead the technical design for the product as well as a chunk of the implementation but left the team mid-2018. I don't have any specific insight into their plans, not that I could really share them even if I did.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#84

Post by mcrute »

WatchDog wrote: post #3

This has been a fairly obvious service that has been missing for a while, nice to see them provide a solution. Most dependency management tools have some kind of hacky support for using S3 directly. Full fledged artifact management tools like Artifactory and Nexus support S3 backed storage. Interesting to see that the pricing is approximately double that of S3, for what I imagine is not much more than a thin layer on…

> Interesting to see that the pricing is approximately double that of S3, for what I imagine is not much more than a thin layer on top of it.

There's a lot of necessary complexity in the backing platform. Encrypted package blobs are stored in S3 but there are a bunch of other distributed systems for doing things like package metadata tracking and indexing, upstream repository management, encryption, auditing, access control, package manager front-ends, etc... that are not immediately obvious and add cost. The platform that backs CodeArtifact is far from what I'd call a thin layer on top of S3. There is also a team of humans that operate and expand the platform.

Source: I lead the technical design for the product as well as a chunk of the implementation but left the team around mid-2018.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#85

Post by swyx »

SeanDav wrote: post #66
ludjer wrote: post #65

Earlier quoted context omitted.

Thanks for letting me know, I will reach out to the HN email and ask them why. I suspect it is because of some comments where I got -Karma.

Looks like a kind mod un-shadowbanned you. Welcome to the land of the living!

despite appearances i'm a very casual HN reader and all this talk of shadowbanning makes me kinda nervous tbh. hope i havent done anything to displease the powers that be.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#86

Post by swyx »

tkahnoski wrote: post #75
scarface74 wrote: post #31

No C#/Nuget support? Really?

AWS products always take an MVP approach. The rest is driven by customer feedback on the roadmap. CodeGuru/CodeProfiler/X-Ray are similar to limited language support they've built out over time. Whenever I see a product announcement like this missing something I need to use it, I immediately ping our Technical Account Manager to get the vote up for a particular enhancement.

sounds surprisingly manual. has AWS not tried to formalize some sort of feature voting system?

Re: AWS CodeArtifact: A fully managed software artifact repository service

#87

Post by tkahnoski »

swyx wrote: post #86
tkahnoski wrote: post #75

Earlier quoted context omitted.

AWS products always take an MVP approach. The rest is driven by customer feedback on the roadmap. CodeGuru/CodeProfiler/X-Ray are similar to limited language support they've built out over time. Whenever I see a product announcement like this missing something I need to use it, I immediately ping our Technical Account Manager to get the vote up for a particular enhancement.

sounds surprisingly manual. has AWS not tried to formalize some sort of feature voting system?

Some products have started doing public github “roadmaps”. Use github issues to get more accessible public feedback but who knows how that gets processed internally.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#88

Post by Bnshsysjab »

txcwpalpha wrote: post #74
Bnshsysjab wrote: post #45

Earlier quoted context omitted.

If you have an app on your computer that is controlled remotely you have _massive_ issues. Creds are stored for SSH, browser, probably heaps of other things too. If this is a serious security concern within your threat model you should be auditing every single package or isolating (docker, vms, Bare metal if you’re super tin foiled), anything short of that is fake security.

>Creds are stored for SSH, browser, probably heaps of other things too. And ideally these credentials should have similar controls applied around them as well (only temporary, using passwords to unlock the SSH keys, etc). If you don't have that, that's your choice, but just because some of your credentials lack security controls is not a reason for other credentials to lack security controls, too. > you should be aud…

There’s a very limited set of scenarios where local file read isn’t accompanied by enough write/exec privilege to inject a keylogger. Sir, there might be some cases where the control would prevent abuse but they’re limited. IMO time/money should be invested in other security over anything more unless you’re literally nearing an absolutely secure environment. In most cases I’ve seen there’s gaping holes while crazy amounts of time and money are spent securing something that doesn’t actually improve overall security much or at all.

Re: AWS CodeArtifact: A fully managed software artifact repository service

#89

Post by SeanDav »

swyx wrote: post #85
SeanDav wrote: post #66

Earlier quoted context omitted.

Looks like a kind mod un-shadowbanned you. Welcome to the land of the living!

despite appearances i'm a very casual HN reader and all this talk of shadowbanning makes me kinda nervous tbh. hope i havent done anything to displease the powers that be.

You are fine. New people with low karma are most at risk. Once you are a little established, you have to do something very upsetting to get shadowbanned, or be consistently unpleasant. Once established, a few controversial posts with negative karma should not be a problem.

Avoid criticizing HN staff or related companies. Gentle / kind disagreement is fine, but err on the side of keeping it private.

Post reply on HN