Hacker News Reader

Things did not worked great, you should see the bad practices about ci/cd, security etc ... let the dev ssh root into a linux box, 1000 days uptime, no patch...

View on HN

I briefly worked for a medium sized web company (millions of registered users, 100's of employees, pretty large infrastructure.) It was hosted on AWS. I would regularly SSH into production instances that had 1000 days uptime, no patches, OS releases that from 5+ years ago, etc.

Oh yeah, they were still running Python 2 for parts of the main application. It was literally like traveling back a decade. I found dependencies that hadn't been updated in 10 years.

Exactly the same things now happen in your cloud provider. Now you just don't see them.

You might see them. But it's far easier for a dev team to take control of the ops side in the cloud with IaC, API's and automated tooling like Terraform. It's still very hard to find companies that do on-prem, API first.

You didn't get the point. Your cloud provider can do things that you don't see and can't control. If you think all cloud provider's employees follows best security practices because they told you so, then good luck.

Reply on news.ycombinator.com