ryan's info is public. he put it on our feedback forum. i wanted to make sure everyone was aware of his public info since we (as well as others) were very concerned with his course of action and questionable statement "Still managed to get a few dozen AWS keys though."
i'm not sure why thanking him is in order... ?
5 people emailed me privately about the security issue. we fixed it promptly, and followed up with instructions to everyone exposed (~20) on how to protect their credentials. i haven't yet heard a complaint from our actual users.
honestly, this was all accidental. it was a pet project we started to toy with Glacier and a week later i accidentally hit the Like button sending a ping to my friends on FB. bless my friends for being so influential i guess. shame on us for using Rails carelessly.
if you have any experience with startups, you'll know that 99% of the things you launch go nowhere--this project was no different. we honestly thought our site was of absolutely no consequence. we're truly thankful so many people found it useful, but trust me we're sorry there was a hole.
however, just to be clear:
- about 20 accounts were exposed, including me and my buddy
- i emailed all of them, and wiped out the credentials
- they quickly responded (i saw the updates come in)
thankfully, AWS is designed for such situations. with a few clicks, people deactivated their credentials (both IAM and main account) and regenerated new credentials. the fact that all the early signups were techies who know their way around AWS really saved us.
one more thing: the correct quote is:
"Glacier is built for durability of 99.999999999%"
also: i agree with ryan--don't trust 10-minute old startups :-)
most likely, we'll just keep a small data center. something to get around the bandwidth limitation and availability. we would definitely need to charge then in order to cover those costs.
all Dropbox apps require approval. someone from Dropbox actually signed up, reviewed IceBox, and approved it.
we have no intentions of competing with Dropbox. (like that's even possible.) if we get a complaint, we're more than happy to comply.
we love both Dropbox and Amazon Glacier so we decided to pair them. i'm almost certain Dropbox will eventually add a similar feature soon--we may just be beating them to the punch.
i built this with a friend and didn't expect it to get posted to HN already. we just got it approved and i accidentally hit our Like button before we were even ready. my friends immediately commented on the story so we just said, what the hey :-)
in any case, it just "launched" today, was only meant for friends to test out, and yes i agree we need to write more copy.
to address some concerns:
- this is really only meant for developers at the moment; i.e. those who actually know their way around AWS. if and when we decide to take payments and provide a service, you can expect a lot more documentation and support. we have no desire to dupe normal folks. we built this for ourselves and really only expected friends to try it out first.
- you don't need to go to your AWS console to get your files. once a file archives, you can click a button to download it back to your Dropbox
- putting in warnings about the quota is a great idea! we'll do that ASAP.
keep the feedback coming, we really appreciate it and wanna build something useful for everyone.
sorry, i just sorta checked everything ;) i'll remove some of those. it's seriously not used for anything. you can actually just watch videos by going to /watch.
this was hacked together in a few nights so it's very incomplete. (collaborative) filtering coming soon.
can you be more specific about how we can improve the home page? we're constantly trying to improve it, but our oldest (and admittedly ugliest) one always converts the best. tell me the dominant page color and i'll know which version you're looking at.
http://zetrip.com/recommendations/landing?u=4015
but i'm not sure if i'd keep coming back to the site. what's the long term vision?