Hacker News Reader

Comment by brandonbloom | Hacker News Reader

Anything that we could do to assuage your concerns?

For what it's worth, we're trying to be extremely thoughtful about security. If it helps (or hurts?), we're a venture backed company, have a published privacy policy, etc. We don't include any anonymous identity tracking, nor do we do any resource crawling, or anything like that. For the CloudTrail feature, we do hit a read-only API endpoint using your browser session, but we don't send any of that data to our servers. We'd never hit any read/write endpoints without you properly granting us an IAM role.

View on HN

Actually, when I checked your website and found that you're venture-backed that made me feel safer. Ultimately, though, the problem is that the tool has too much access. I might prefer to use a role provisioned into my account to use a dedicated better console experience way before I would use the extension (it acting as me is too much exposure for me). As it so happens I find the console not too bad as it stands so maybe that's part of it.

I know you guys are well-intentioned and I'm trying to help you here by finding out what the key thing is that would make me comfortable and I'm really coming up with nothing. I just think it's too much power to get not that much utility for me.

Sorry I couldn't come up with anything concrete.

Thanks for the perspective!

I'm most interested in this:

> too much power to get not that much utility

Is there something that pains you enough that if you had a fix for it, you'd overlook your security concerns?

In the AWS console, no.

However, I have used those extensions that merge Google Calendar events together and that was borderline for me. I think if I had a tool that would generate Terraform based on the summary page of an AWS construct I might consider using the extension. It would still be a reach though.

> if I had a tool that would generate Terraform based on the summary page of an AWS construct

This is definitely something we've considered. Our primary platform over at https://www.deref.io/ (still in closed beta) can export resources to Terraform or Pulumi. Video from a few months ago available here: https://youtu.be/DsZsYs_N4NU – If that's interesting to you, drop us a note at hello@deref.io and we can talk about your needs.

Thanks for sharing that. Full disclosure: this is also not a significant pain point for me.

One thing you can do is make the extension source-available.

Reply on news.ycombinator.com