Hacker News Reader

Comment by moe | Hacker News Reader

Sorry, your registration procedure is a failure. Make a live-demo available right on the front-page.

Nobody in their right mind gives you their AWS-credentials just to get a glimpse at your product.

Agreed. What type of app requires you to give up your credentials to something as sensitive as your infrastructures credentials?! No fucking way. Fix this asap.

Edit: Any admin that gives these up should probably not be in the role they are. I'd fire someone over something like this. The OP commented further down that "64%" gave up their credentials. I think their bosses need to know about that or their clients should be warned.

I don't care who this guys is and how much assurance he can offer; there is no reason for this.

It's no different than how RightSignature/Scalr works. And both of those services seem to be doing pretty well.

Thanks for the feedback. Can I ask what you would suggest as an alternative for people wanting to try the product? Our app is useless without access to the AWS APIs, and although IAM credentials could be created (as people below have), for the app to be fully functional it would require near full access permissions anyway.

We definitely need to give more before users have to enter their credentials, like a tutorial and demo video which are in the works, but as far as actually using the product, I don't see a way around it.

As noted below, this is actually very common. RightScale, Scalr, OpDemand, NewVem, and all other AWS third party tools require this information.

Not trying to say you are wrong, you're not, it's rightfully a big concern for people, but unless AWS change the way their APIs work, what are we supposed to do?

Write stubs

Can't you give access to the UI, let people build out an infrastructure, and then if they want to actually launch it, ask for IAM credentials then?

That's a good idea, although it would limit the features to just being a diagramming tool, but at least they can take a look. Really good suggestion, will give it some consideration, thanks.

We are implementing this suggestion at the moment, thanks a lot for the fantastic feedback.

I created a privilege-less IAM user and that seemed to do the trick.

Thats not really the point, I think.

I suppose creating a privilege-less IAM user to test web apps is going to become as prevalent as having a throwaway junk email address.

It allowed me in to at least test out the interface, where I was able to determine that some of the pretty stuff on the home page (autoscaling, for example) doesn't seem to be available yet.

Sorry, I tried to get a balance between showing what we currently support and what we are working towards on the homepage, not sure if I got it right.

RDS support is coming soon (approximately one month) and ELB support to be added shortly after that. AutoScaling and Availability Zones are both high priority, but we have very limited resources and I can't commit to a timeframe at the moment.

Thanks for creating IAM credentials and trying us out. If you have any suggestions on how to improved credential handling, please let me know.

Thanks for the honest criticism. I mostly agree and a video demo is in the works, although a full dummy demo would divert considerable resources away from developing the product at this stage.

Reply on news.ycombinator.com