Ignoring all the warts of how schizophrenic the different AWS layers are, I pers... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

pram on Nov 12, 2022 | parent | context | favorite | on: AWS IAM Roles, a tale of unnecessary complexity

Ignoring all the warts of how schizophrenic the different AWS layers are, I personally like the policy document format.

I wouldn’t mind a similar style at the OS/kernel level for control groups and other permissions of that type. Having a list of principals and allowed operations would be easier to reason about (imho) than systemd unit files, or selinux, or filesystem permissions, or firewall rules, or the rest of the mess which is Linux security.

I think Fuchsia is doing something exactly like that?

hedora on Nov 12, 2022 | [–]

Unix groups are much, much easier to correctly configure than everything you mentioned, and at least an order of magnitude simpler as well.

jerjerjer on Nov 12, 2022 | [–]

To be fair selinux is a bar so low you'd have to dig to do worse.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact