640
641

My $2375 Amazon EC2 Mistake (devfactor.net)

godlikesme が 投稿

並べ替え:
ベスト
ベスト
トップ
新着
注目
論争中
古い順
あなたは単独のコメントのスレッドを見ています。

残りのコメントをみる →

[–]RagingOrangutan 146 ポイント147 ポイント  (26子コメント)

Tl;Dr: accidentally posted EC2 API key to GitHub, bot picked it up and started mining bitcoins, Amazon gives his money back.

No idea why we needed all the back story about his rails app and what tutorials he used.

[–]am0x 80 ポイント81 ポイント  (17子コメント)

Because it is an article/blog. It's not a scientific paper, it is a story.

[–]RagingOrangutan 4 ポイント5 ポイント  (0子コメント)

Sure, but even stories should be somewhat focused on the topic at hand. I don't typically start my stories with the details of my birth, for example.

[–]1lIl1Il1lIl11lI 18 ポイント19 ポイント  (15子コメント)

Because it is an article/blog

This is a miserable excuse. The details about Ruby, packages, tutorials, how many hours it took, etc, all had literally nothing to do with the actual subject of the article, which is that a guy put API keys on Github (which could have been in a README, javascript, perl, C#, PHP, Java.....it is irrelevant) and someone used his account for nefarious purposes.

Color background can be interesting, but in this case the reader is unnecessarily wading through and trying to discern and remember details that end up being completely irrelevant.

[–]General_Pie 8 ポイント9 ポイント  (0子コメント)

I just skipped to the end, totally agree. All that guff was not worth reading.

[–]lIlIlIIIlllIIlIIIlll 5 ポイント6 ポイント  (1子コメント)

In fact, it wouldn't have even mattered if it was in the repo if he had used a private repo. I know everyone has a hard-on for github, but you can easily run your own git repo if you can't justify the cost of paying github. There's even a free github clone called gitlab that allows you to run a private repo on your own server.

[–]RockMeetHardPlaces 3 ポイント4 ポイント  (0子コメント)

or bitbucket - but yea gitlab is pretty f'in awesome (we use it at work)

[–]chucker23n 15 ポイント16 ポイント  (11子コメント)

Oh noes. How dare someone write something you're not interested in! On the Internet, no less!

[–]prepend 23 ポイント24 ポイント  (0子コメント)

It's ok to not like stuff. The article was posted to reddit for voting and comment. It seems odd to complain that someone is complaining about something posted to reddit.

Following your logic, no one should complain about things, so you shouldn't post your comment.

[–]unique_id 1 ポイント2 ポイント  (8子コメント)

He's probably got a point. The internet must be getting close to being full by now.

I thought the blog was interesting, so if there's some sort of voting arranged to decide what can stay, my vote is that this particular page is okay.

[–]1lIl1Il1lIl11lI -4 ポイント-3 ポイント  (7子コメント)

The internet must be getting close to being full by now.

Another "sounds more clever than it actually is" bit of snark.

People discuss stuff on Reddit. If you think otherwise, you are, it seems, sadly mistaken. In this case that this blog entry is a giant waste of most reader's time and attention (which is something that is in very short supply).

Next up -- six paragraphs about my breakfast, followed by a sentence saying that my CPU overheated until I used pressurized air to clean the dust off.

[–]unique_id 0 ポイント1 ポイント  (6子コメント)

I recommend you don't check out thedailywtf.com then. Amongst many others, the site is built on the premise that adding some flavour to an otherwise technical goof will be sufficient to bring repeat visitors looking for some amusement.

'A spoonful of sugar' and all that...

[–]1lIl1Il1lIl11lI 2 ポイント3 ポイント  (5子コメント)

Have you noticed how seldom TheDailyWTF appears on tech social news sites lately? That is exactly why - the site reads like a Grade 8 creative writing assignment.

[–]suicidalfitnessfreak 1 ポイント2 ポイント  (4子コメント)

tech social news sites tend to fetishize the "new", when the dailywtf was new and posting interesting stuff it was regularly featured.
it's practically ancient in web terms. i actually found it again a couple of days ago and thought - "huh, this thing still exists, i thought it was a joke?". just like your fucking homepage is funny the first few times and just feels old hat after a couple of weeks
edit: the clickbait era doesn't help, most of the stuff on there has "clickbaitesque" titles

[–]1lIl1Il1lIl11lI 0 ポイント1 ポイント  (3子コメント)

Remember this - http://thedailywtf.com/articles/Announcement-A-New,-New,-New-Name!

However I do remember TheDailyWTF -- in its original incantation -- being simple, concise anti-patterns. It was dominated with bad code. It was popular.

It was later that it started to become a creative writing, narrative driven site. Where a three page story culminates in a dumb manager trying to push his car keys into a USB slot.

[–]1lIl1Il1lIl11lI 1 ポイント2 ポイント  (0子コメント)

Oh noes. Someone has a criticism that you disagree with! On the Internet, no less!

Is that as clever? Because your point is ridiculous. An enormous number of /r/programming readers are going to wallow through that article (presuming they read it, which generally people don't), get to the end and come to the same conclusion as the tldr; person above. Information is presented purely for the purposes of fluffing up next to no content, and the end result is not good for the result.

[–]bob_belche 5 ポイント6 ポイント  (0子コメント)

Well you missed a big part, in that he thought it was just an S3 key. I would have thought the same, but still revoked it.

[–]Talman 4 ポイント5 ポイント  (2子コメント)

Marketing. People now know about his rails app.

[–]merreborn 4 ポイント5 ポイント  (1子コメント)

I wasn't under the impression his one-day yelp clone was a commercial endeavor. ...

[–]suicidalfitnessfreak 3 ポイント4 ポイント  (0子コメント)

his brand is though. i don't even bother reading the name of the author or website on titles like these.
it's just to "get the word out" and promote his website to potential employers/startup partners

[–]ABC_AlwaysBeCoding 2 ポイント3 ポイント  (0子コメント)

As an experiment I used the OS X "semi-hidden" Summarize feature to summarize the entire blog article. Right around the 3% mark it cut it down to this:

"Turns out through the S3 API you can actually spin up EC2 instances, and my key had been spotted by a bot that continually searches GitHub for API keys. Amazon AWS customer support informed me this happens a lot recently, hackers have created an algorithm that searches GitHub 24 hours per day for API keys… Once it finds one it spins up max instances of EC2 servers to farm itself bitcoins…"

I have no idea how it knew exactly what the relevant bit was, but for what it's worth... it did.

[–]_scape 2 ポイント3 ポイント  (1子コメント)

Turns out through the S3 API you can actually spin up EC2 instances

how does a s3 key provide opportunity to spin up ec2's? I can't seem to find information about this; any ideas?

[–]Ashex 8 ポイント9 ポイント  (0子コメント)

Seems to me that the author didn't create an iam with a policy restricted to a bucket and just used the root account credentials.

[–]MastersInDisasters -1 ポイント0 ポイント  (0子コメント)

He's hoping to get a job at CNN.