[wkat4242]

An 'open S3 bucket' sounds really bad. If it were posted on an HTTPS site without authentication, like the firmware for most devices, it wouldn't sound so bad.

Sure an open bucket is bad, if it's stuff you weren't planning on sharing with the whole world anyway.

[necovek]

Since firmware is supposed to be accessible to users worldwide, making it easier to get it is good.

But how is an open, read-only S3 bucket worse than a read-only HTTPS site hosting exactly the same data?

The only thing I can see is that it is much easier to make it writeable by accident (for HTTPS web site or API, you need quite some implementation effort).

[wkat4242]

No wait I agree with you. I think it is bad framing as "S3 open bucket" when people would totally understand an open website :)

[locknitpicker]

> An 'open S3 bucket' sounds really bad.

Only to gullible, clueless types.

Full blown production SPAs are served straight from public access S3 buckets. The only hard requirement is that the S3 bucket enforces read-only access through HTTPS. That's it.

Let's flip it the other way around and make it a thought experiment: what requirement do you think you're fulfilling by enforcing any sort of access restriction?

When you feel compelled to shit on a design trait, the very least you should do is spend a couple of minutes thinking about what problem it solves and what are the constraints.

[wkat4242]

No I agree with you. I think it is bad framing as "S3 open bucket" when people would totally understand an open website :)

I'm not shitting on anything except the wording in the article.

I guess I didn't word it clearly.

In our company we don't really serve directly from open buckets but through cloudfront. Though this is more because we are afraid of buckets marked open by mistake so they are generally not allowed. But I agree there's nothing bad about it. I just meant it sounds much worse (at least to someone in cybersec like me) and I don't like the effect used as such in the article.