frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Bucketsquatting is (finally) dead

https://onecloudplease.com/blog/bucketsquatting-is-finally-dead
62•boyter•1h ago

Comments

lijok•1h ago
Huh? Hash your bucket names
Maxion•1h ago
I don't think that'd prevent this attack vector.
alemwjsl•20m ago
Ok; salt, and then hash your bucket names
why_only_15•1h ago
if your bucket name is ever exposed and you later delete it, then this doesn't help you.
calmworm•1h ago
That took a decade to resolve? Surprising, but hindsight is 20/20 I guess.
thih9•1h ago
> If you wish to protect your existing buckets, you’ll need to create new buckets with the namespace pattern and migrate your data to those buckets.

My pet conspiracy theory: this article was written by bucket squatters who want to claim old bucket names after AI agents read this and blindly follow.

vhab•1h ago
> For Azure Blob Storage, storage accounts are scoped with an account name and container name, so this is far less of a concern.

The author probably misunderstood what "account name" is in Azure Storage's context, as it's pretty much the equivalent of S3's bucket name, and is definitely still a large concern.

A single pool of unique names for storage accounts across all customers has been a very large source of frustration, especially with the really short name limit of only 24 characters.

I hope Microsoft follows suit and introduces a unique namespace per customer as well.

ryanjshaw•52m ago
I recall being shocked the first time I used Azure and realizing so many resources aren’t namespaced to account level. Bizarre to me this wasn’t a v1 concern.
iann0036•38m ago
Author here. Thanks for the call out! I've updated the article with attribution.
Aardwolf•1h ago
Why all that stuff with namespaces when they could just not allow name reuse?
CodesInChaos•49m ago
I'd allow re-use, but only by the original account. Not being able to re-create a bucket after deleting it would be annoying.

I think that's an important defense that AWS should implement for existing buckets, to complement account scoped bucket.

iknownothow•33m ago
Potential reasons I can think of for why they don't disallow name reuse:

a) AWS will need to maintain a database of all historical bucket names to know what to disallow. This is hard per region and even harder globally. Its easier to know what is currently in use rather know what has been used historically.

b) Even if they maintained a database of all historically used bucket names, then the latency to query if something exists in it may be large enough to be annoying during bucket creation process. Knowing AWS, they'll charge you for every 1000 requests for "checking if bucket name exists" :p

c) AWS builds many of its own services on S3 (as indicated in the article) and I can imagine there may be many of their internal services that just rely on existing behaviour i.e. allowing for re-creating the same bucket name.

dwedge•7m ago
I can't accept a) or b). They already need to keep a database of all existing bucket names globally, and they already need to check this on bucket creation. Adding a flag on deleted doesn't seem like a big loss.

As for c), I assume it's not just AWS relying on this behaviour. https://xkcd.com/1172/

INTPenis•55m ago
I started treating long random bucketnames as secrets years ago. Ever since I noticed hackers were discovering buckets online with secrets and healthcare info.

This is where IaC shines.

XorNot•44m ago
I just started using hashes for names. The deployment tooling knows the "real" name. The actual deployment hash registers a salt+hash of that name to produce a pseudo-random string name.
Galanwe•37m ago
This is all good and we'll on the IaC side,yes. But at the end of the day, buckets are also user facing resources, and nobody likes random directory / bucket names.
iknownothow•23m ago
Thank you author Ian Mckay! This is one of those good hygiene conventions that save time by not having to think/worry each time buckets are named. As pointed out in the article, AWS seems to have made this part of their official naming conventions [1].

I'm excited for IaC code libraries like Terraform to incorporate this as their default behavior soon! The default behavior of Terraform and co is already to add a random hash suffix to the end of the bucket name to prevent such errors. This becoming standard practice in itself has saved me days in not having to convince others to use such strategies prior to automation.

[1] https://aws.amazon.com/blogs/aws/introducing-account-regiona...

alemwjsl•18m ago
I take it advertising your account id isn't a security risk?
aduwah•14m ago
It is not hygienic, but with only the account-id you are fine. In the IAM rules the attacker can always just use a * on their end, so it does not make a difference. You have to be conscious to set proper rules for your (owner) end tho.

Russia is carrying out a cyber campaign targeting Signal and WhatsApp accounts

https://www.aivd.nl/actueel/nieuws/2026/03/09/rusland-voert-cybercampagne-uit-tegen-signal--en-wh...
1•komape•59s ago•0 comments

How to make your own static site generator

https://gaultier.github.io/blog/how_to_make_your_own_static_site_generator.html
1•gingersnap•1m ago•0 comments

YouTube videos that have almost zero previous views

http://astronaut.io/
1•Zealotux•2m ago•1 comments

I traced $2B in grants and 45 states' lobbying behind age‑verification bills

https://old.reddit.com/r/linux/comments/1rshc1f/i_traced_2_billion_in_nonprofit_grants_and_45/
3•shaicoleman•8m ago•0 comments

The End of the Open Web

https://www.netmeister.org/blog/open-web.html
2•speckx•8m ago•0 comments

50 Years of Thinking Different

https://www.apple.com/50-years-of-thinking-different/
2•tilt•11m ago•0 comments

Show HN: Privacy Mask – prevent secrets leaking to AI agents

2•fullstackcrew•12m ago•0 comments

Show HN: fftool – A Terminal UI for FFmpeg – Shows Command Before It Runs

https://bensantora.com/posts/fftool-ffmpeg-tui-go/
2•taskset•15m ago•0 comments

Benchmarking Hosted Browser Providers: Speed, Stealth, Captcha, and Concurrency

https://techstackups.com/comparisons/hosted-browser-benchmarks/
2•ritzaco•15m ago•0 comments

How to Run a Pool of Autonomous Coding Agents on Your Jira Backlog

https://jaksa.me/blog/2026-03-01-pool-of-agents
2•jaksa•16m ago•0 comments

Advertising was always going to come for AI chatbots. The real question is how

https://reutersinstitute.politics.ox.ac.uk/news/advertising-was-always-going-come-ai-chatbots-rea...
2•jruohonen•19m ago•0 comments

Show HN: I forked Python's Requests to add HTTP/3, async, and multiplexing

https://github.com/jawah/niquests/tree/v3.18.2
2•mesahm•22m ago•2 comments

Beyond Agents.md: Harness Eng, Loop-Based Delivery, and Context-Aware Prompting

https://teamcadence.ai/blog/context-aware-prompting/
4•daveslutzkin•23m ago•0 comments

Updates on Analyst Platform for Data Analysts

https://anallyst.onrender.com
2•Sechele•23m ago•0 comments

AI Isn't People

https://www.todayintabs.com/p/a-i-isn-t-people
3•q-base•23m ago•0 comments

Show HN: I wrote a free trilogy about perception, presence, and leadership

https://marcus-corvin.github.io/thecalibratedview/
3•mr_octopus•25m ago•1 comments

How Japan Is Buying Back Its Semiconductor Industry [video]

https://www.youtube.com/watch?v=9t9D0gVfPX4
2•mgh2•28m ago•0 comments

Show HN: Payment Hunter – AI-powered invoice reminders for freelancers

2•paymenthunter01•29m ago•0 comments

What do coders do after AI?

https://www.anildash.com/2026/03/13/coders-after-ai/
2•speckx•30m ago•0 comments

Slate: Moving Beyond ReAct and RLM

https://randomlabs.ai/blog/slate
2•vinhnx•32m ago•0 comments

Safety Agents for Autonomous Systems

https://stackresearch.org/blog/control-ops/
2•dnmacon•33m ago•1 comments

Claude can generate custom diagrams, and charts directly in your conversation

https://support.claude.com/en/articles/13979539-custom-visuals-in-chat
2•simianwords•33m ago•0 comments

Claude now has Generative UI – interactive charts and diagrams

https://twitter.com/claudeai/status/2032124273587077133
2•simianwords•35m ago•1 comments

Show HN: Cigarette Rocket Booster – a rocket where the body itself is fuel

https://github.com/solenopsys/CRB
2•solenopsys•35m ago•0 comments

Show HN: JobStocks – track hiring changes at public companies vs. stock price

https://jobstocks.ai/
2•TalO•38m ago•0 comments

Source code of Swedish e-government services has been leaked

https://darkwebinformer.com/full-source-code-of-swedens-e-government-platform-leaked-from-comprom...
3•tavro•38m ago•0 comments

SSL/TLS and PKI History

https://www.feistyduck.com/ssl-tls-and-pki-history/
2•fanf2•42m ago•0 comments

Virtual Scrolling: Rendering messages without lag

https://kreya.app/blog/using-virtual-scrolling/
2•CommonGuy•43m ago•0 comments

Pentagon AI chief praises Palantir tech for speeding battlefield strikes

https://www.theregister.com/2026/03/13/palantirs_maven_smart_system_iran/
2•jjgreen•46m ago•0 comments

Major Outage in Datadog Web Application

https://status.datadoghq.com
3•nzach•49m ago•0 comments