Hacker News Reader

Comment by privateSFacct | Hacker News Reader

This again is misleading, users blaming AWS for making bucket's public.

The bucket's start out __private__.

The UI when making a bucket public comes with a big warning.

Then a big warning label is attached next to the bucket itself.

It does show I think the scale of AWS that the userbase is so large that this isn't clear. This tool is nice because it means that a perhaps more experienced admin can lock down an entire account a bit more so newer devs looking to shortcut things with world public aren't as able to (which will slow them down for sure).

View on HN

>> he bucket's start out __private__.

Except one of the biggest initial selling points is hosting static websites, which requires the bucket to be public. They even have a shortcut UI for setting this up, but then they highlight this "security issue" that you have a public bucket, which doesn't make sense.

If you've gone to the trouble to specify the bucket is a website with default documents, etc, surely they can filter these buckets out of the ALERT! PUBLIC BUCKET! list...

> Except one of the biggest initial selling points is hosting static websites, which requires the bucket to be public.

Maybe S3 should just be separated into buckets and websites. They can work the same under the hood, but call them something different to prevent this issue. Right now a lot of the new (and existing) security settings don't make any sense in the context of websites, and having the functionality to make websites within S3 creates security issues for everyone else.

While buckets are great for pushing your static content too, I would probably put a CDN in front of it, which is pretty easy to do with CloudFront.

Not only is it’s faster it’ll likely be cheaper, due to reads from S3 being more expensive than content read from a CDN. (AFAIK)

Edit: that said I use to use S3 for hosting a few toy sites, that were inside jokes between my friends. For sites like that maybe glitch.com or github pages might work better ¯\_(ツ)_/¯

My understanding was most of these issues came from setting permissions to "Everyone" and assuming an implied "with access to this aws account" that isn't there. I don't think it's people explicitly turning it to private. That said, it's a couple of years since I used AWS.

There is a large notice when you do it and It shows up in the Trusted Advisor service that warns you when you’re doing things in an insecure way.

The tricky case is a bucket which is otherwise private but contains individual files that were uploaded with a public ACL (or had the ACL modified, of course). This is not made apparent anywhere in the interface (by which I mean there isn't some big "public" sticker), and is part of what this feature is trying to address.

IIRC they didn’t used to be private by default or it was really easy to make it public.

They have been private by default since the launch of S3 in 2006.

Reply on news.ycombinator.com