Hacker Newsnew | past | comments | ask | show | jobs | submit | st3fan's commentslogin

I just put something similar together but then on top of Openbao which generates temporary credentials/roles for Postgres. I created a website where people can request access and a specific group of people can approve the approve. After being approved, the database users can request temporary credentials in OpenBao for a specific number of hours.


Wow, this is same thing that this currently does, but aside from database creds are there any other kinds of credentials you've worked with?


This is a great tool.

Do you also mark records that point to private IP space? (192.168/16, etc.)


Hey st3fan! Thanks! Yes we do!


The first two cases indicate that you have some gaps in your change management process. Strict requirements for pulls and ci/cd checks.


Correct. These are called "residential proxies".


Great victim blaming there buddy.


To what extent is the victim their own perpetrator? They allow the status quo to succeed by endorsing it. They voted for this with $30,000 of their own money, and they will likely vote again.


So taking a wrong turn should result in you being mugged, raped and subsequently killed because apparently there was some "safe", but less convenient, passage? You're not helping OSS by making claims like these.


Obviously you're being facetious, that is not at all what that poster is claiming.

While I agree that entering a dark alley shouldn't result in ill effects, if ill effects happen in said dark alley it is still worth the discussion to remind people to stay out of dark alleys in today's day and age (or until the root problem, whatever it is, is improved).

Pretending that it is OK to enter dark alleys and forcing blame elsewhere will continue to have people unwittingly enter dark alleys.


> While I agree that entering a dark alley shouldn't result in ill effects, if ill effects happen in said dark alley it is still worth the discussion to remind people to stay out of dark alleys in today's day and age (or until the root problem, whatever it is, is improved).

This is not a dark alley. It's the main street. It's the world we live in. iPhone has more than half the market share in the US and well over a billion users worldwide. Moreover, Apple, Google, and Microsoft collectively monopolize consumer operating systems on both mobile and desktop. Try going into a retail store and buying a computing device that is not running iOS, Android, macOS, or Windows. That's the reality for most people.

The dark alleys are the non-mainstream options that hardly anyone knows about.


To further stretch the analogy: the main street is now full of potholes, sinkholes, and even landmines. The root problem is that, in exchange for convenience, we as a society have ceded too much power to these large businesses and we are now paying the price for it. We have bought the proverbial monorail [1] and now we are stuck with it.

[1] https://www.youtube.com/watch?v=taJ4MFCxiuo


> The root problem is that, in exchange for convenience, we as a society have ceded too much power to these large businesses and we are now paying the price for it.

I don't know why some people have made "convenience" into a dirty word. Almost everything we do is for convenience. You could live in a remote log cabin with no electricity and grow/hunt your own food, separating yourself from most of society, but that wouldn't be convenient or pleasant.

Individual consumers have very little power over the market. There's a collective action problem, which is why governments and regulation exist... or should exist. The way I see it, the root problem is a massive failure by (corrupt) governments to protect consumer rights.


How do governments become corrupt in the first place though, if they don't start that way? It's collective action problems all the way down.

Perhaps the root problem is that we've blown too far past Dunbar's number to be able to deal with the societies we live in. All of these systems we've contrived to mitigate the trust problem are full of holes.

As for convenience, that carries a tradeoff. All of the technology and all of the revolutions we've had (agricultural, industrial, information technology) have come with these tradeoffs. Even the log cabin has downsides compared to the nomadic hunter-gatherer lifestyle.


> How do governments become corrupt in the first place though, if they don't start that way?

I think the US government did start that way. Maybe not "corrupt" as such, but the United States was founded by plutocrats and was clearly designed to protect the minority of plutocrats against mass democracy.

> Even the log cabin has downsides compared to the nomadic hunter-gatherer lifestyle.

Yes, but I'd say the nomadic hunter-gatherer lifestyle has even greater downsides, and our current state of convenience is in many ways a vast improvement over the precarious existence of our distant ancestors.


There are 1.5 BILLIONS of iOS users. Is that what you call a dark alley? This is a broad day, city center attack.


So many asslickers of Apple here, blaming the victim when clearly anyone could be the next victim. The same issue with clouds like Google Cloud that can charge you 100k USD tomorrow just because of someone doing a loop of wget on a cdn endpoint.

The real solution is to have a neutral, efficient and formal process under supervision of regulators to have such case escalated and handled.

I already see all the tech-bros coming: “you see it was not an issue, they reinstated the account after you posted” while ignoring there are silent victims.


If I entrust money to someone who I know to be a thief, and then he runs off with it, how am I not at least partially culpable for my own negligence? Obviously the thief is the criminal and deserves to be punished and to pay restitution, but the idiot who should know better isn’t blameless.

One can express a need for regulation while also being aghast that people are still falling for the cloud scam, despite the overwhelming evidence that it is indeed a scam.


> I know to be a thief

A trillion dollar company with premium hardware and software that has more than 50% smartphone share in US and is used by 1.5 billion people worldwide is not "know to be a thief".

Your rant is essentially a crazy hobo stashing cash under his mattress and calling anyone using a bank idiot.


Banks, except for Wells Fargo, are not known to steal your money. Cloud services, however, are well-known for this kind of thing, especially in tech circles. Most people think it’s so rare that it won’t happen to them. And they are right, statistically, but they don’t consider the outsized impact if they are wrong.

Most people don’t save enough to handle an emergency, even if they have the cash flow for it. Most people don’t do basic, cheap preparation for a natural or manmade disaster. Most people don’t do at least minimal planning to make life easier for their families and loved ones if they are incapacitated or die, until very late in life. Most people are indeed idiots.


Calling 1.5 billion people idiots because they use a service where this happened to like one guy is too much of a stretch.


More like taking a deal with the devil and then being surprised that you lost your soul.


That's not what happened here though. The victim paid the muggers... so as you can see something is very wrong in this relationship.


Victim blaming is simply a way to feel comfortable that it won’t happen to you. The takeaway should be that it CAN happen to you.


I don't use apple products

read the TOS before agreeing


Let’s be real, the number of people who read it approaches zero.

Not only does no one read it but it seems like they are intentionally designed to be difficult to read.

They are written by lawyers for lawyers, not for common people to read.


You don't even have to actually read them, just assume the worst case for the customer and you'll be right.


LLMs actually do a good job at reading legalese, this may finally reverse the trend of corporations using inpenetrable language to screw over customers.

Of course, that doesn't help in the US with its vicious Supreme Court endorsing the most blatant abuses under cover of binding aritration.


And then what? Go to Google, Samsung, any other Android vendor and read the same TOS?

There should be laws to protect people, instead of blaming victims.


Every single cloud storage provider has a generic cop-out clause in their TOS that allows them to lock you out of your account for no reason at all, with no legal obligation to provide any proper justification.

This leaves you with just about zero cloud storage solutions that you can use.

Yes, yes, you can rsync your files to your NAS. Now explain that to your non tech-savvy neighbors.


I'm just one data point but .. who uses the frontpage? I go there to work on my projects. I've never been on pages other than in my org or projects.


What a story. EOL the open source foundation of your commercial product, to which many people contributed, to turn it into a closed source "A-Ff*ing-I Store" .. seriously what the ...


Didn't contribute to MinIO, but if they accepted external contributions without making them sign a CLA, they cannot change the license without asking every external contributor for consent to the license change. As it is AGPL, they still have to provide the source code somewhere.

IANAL, of course


They required a "Community Contribution License" in each PR description, which licensed each contribution under Apache 2 as an inbound license.

Meanwhile, MinIO's own contributions and the distribution itself (outbound license) were AGPL licensed.

It's effectively a CLA, just a bit weaker, since they're still bound by the terms of Apache 2 vs. a full license assignment like most CLAs.


People underestimate the amount of fakeness a lot of these "open-core/source" orgs have. I guarantee from day one of starting the MinIO project, they had eyes on future commercialization, and of course made contributors sign away their rights knowing full well they are going to go closed source.


Well, you can not have a product without having "AI" somewhere in the name anymore. It's the law.



back in 2018, it didn't feel this way


This is why I don't bother with AGPL released by a company (use or contribute).

Choosing AGPL with contributors giving up rights is a huge red flag for "hey, we are going to rug pull".

Just AGPL by companies without even allowing contributor rights is saying, "hey, we are going to attempt to squeeze profit out and don't want competition on our SaaS offering."

I wish companies would stop trying to get free code out of the open source community. There have been so many rug pulls it should be expected now.


What's the problem? Surely people will fork it


I still don't understand what the difference is.

What is an AI Stor (e missing on purpose because that is how it is branded: https://www.min.io/product/aistor)


Might be because of this other storage product named that https://github.com/NVIDIA/aistore


Does anyone use this? I was setting it up a few months ago but it felt very complicated compared to MinIO (or alternatives). Is there a sort of minikube-like tool I could use here?


There's a development/playground deployment for local K8s (e.g. Minikube, KinD): https://github.com/NVIDIA/aistore/tree/main/deploy/dev/k8s.

For production you'd need a proper cluster deployed via Helm, but for trying it out locally that setup is easy to get running.


It can store things for AI workloads (and non-AI workloads, but who’s counting…)


About a billion dollars difference in valuation up until the bubble pops.


Looks like AI slop

    Replication

    A trusted identity provider is a
    key component to single sign on.
Uh, what?

It’s probably just Minio but it costs more money.


"If someone wants hype or the latest shiny thing every month, they have Linux."

This is just such a bizarre view ... what do they think Linux really is? Maybe if you are on bleeding edge Arch as a hobbyist who follows the latest shiny windows managers or something like that. But those of us who run Linux in production do that on stable releases with proven tech that hasn't changed significantly in more than a decade. Or longer for some things.

The FreeBSD folks need a reality check. They are so out of touch with what Linux really is. It is hard to take these kind of articles seriously.


> But those of us who run Linux in production do that on stable releases with proven tech that hasn't changed significantly in more than a decade.

Pretty sure the firewall commands have changed at least once in that time, and the device layer and maybe the init system. I hear the preferred sound system is changing again in the last few years too.


Yeah no. Wishful thinking. History has shown that huge corporations taking over open source project generally results in a big change how those projects are governed and how the legalese like t&c turns out.

Not a lawyer obviously - but lets see how this plays out.


Another VPN advertisement.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: