this post was submitted on 31 Jul 2025
434 points (99.3% liked)
Technology
73534 readers
2429 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is why you don’t vibe code a webservice
This wasn't vibe coding, it's incompetant devops.
You have to go out of your way to make these buckets public like this. Several giant "Everyone will have access to this" warnings, re-authentication, a permanent warning symbol on the dashboard AND regular e-mails reminding you that you have a public bucket. I don't even think you can do this via the API, it requires a human to manually make this setting.
I'm guessing that they couldn't figure out how to configure the Access Control Lists and just made it public so that it would work. That's fine in a test environment, without any user data but it's pure incompetence to have a production system setup this way.
I’d say it’s not fine in a test environment, because then your test env S3 bucket is publicly available.
It's not great, but it's an acceptable kludge if you're the one holding everyone back and you can't figure out the problem immediately. Set it to public, let the devs get to work and research the problem until you find a real solution.
The test environment data should be generic so if someone were to discover the bucket they'll get some pictures of cats and a bunch of people who live at 12345 anywhere street.
It’s a bad idea to leave your S3 perms wide open, because then anyone can use your S3 bucket for whatever reason they want, and it’ll hit your wallet. And if they can’t figure out basic IAM and ACLs, I’m also betting they can’t figure out “requester pays”
What? No, this is a horrible practice.
If you can't figure out how to set identity-based ACLs you shouldn't be working in technology! Oh I'll just set this shit to any/any and figure out later. FUCK ANYONE WHO DOES THIS IN THEIR LEFT EAR.