[tazjin]

> So Amazon could easily have tested their client on 3rd party servers and still not spotted the problem

This would still be a red flag, as the service in question is their instance metadata service that provides authentication tokens.

Something that important should be integration-tested with the actual service.

[hnlmorg]

> This would still be a red flag,

Perhaps I don't understand the issue you're discussing but how would the client working on 3rd party services be a red flag when that is the desired behavior?

[tazjin]

Sorry if this was unclear: It's a client that they specifically wrote to talk to their own services, and they're releasing it to their customers as an official way to talk to their own services. It could not talk to their own service.

Their own documentation refers to that library (or did at that point in time, not sure about now).

[hnlmorg]

Ahh I did misunderstand you then. Sorry. Yeah that does sound bad.