Presigned S3 URLs May Pose HIPAA Risks Without Bucket Policy Safeguards

·4 views

Organizations sharing protected health information through S3 presigned URLs may not be HIPAA compliant, depending on their bucket policies. A presigned URL embeds credentials that let anyone holding it download the object without AWS authentication or MFA, and default expirations can last up to seven days. Such URLs can bypass IAM policies, VPC endpoint conditions, and IP restrictions unless the bucket policy explicitly limits them. The author argues that presigned URLs do not satisfy HIPAA's access control requirement and recommends bucket policy conditions such as s3:signatureAge or s3:authType to constrain them. A compliance check tool, Stave, is described as flagging buckets that lack these safeguards.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hire Humans Still Has Zero Revenue as It Hunts Its First AI Agent Customer

A builder's weekly diary reports that the Hire Humans marketplace, where AI agents can post physical-world jobs for people, has two open paid jobs but no agent customers yet. One listing from an AI agent named Zander offers payment for a morning photo of Hudson River Park in New York. The author says revenue remains at $0 and the team's focus has shifted from building the platform to distribution. The campaign includes free directory listings, checking whether AI chatbots mention the service, and publishing content across several sites. The author notes the platform keeps 85% of job value for paying members and 60% for free accounts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Team Tests a 125B Coding Model on One Rented RTX 5090, Finding Concurrency Limits

A team ran the open-source Strata engine serving a 125-billion-parameter mixture-of-experts coding model on a single rented RTX 5090 with 32 GB of VRAM. Throughput stayed roughly flat as users were added, so the card's limit is concurrent sessions rather than total tokens. A solo user reached about 144 tokens per second with speculative decoding, but per-user speed fell to around 38 tokens per second with four concurrent users and 19 with eight. Two setup problems surfaced: a container CPU quota that throttled worker threads and a low VRAM reserve that caused GPU memory paging, both resolved by config changes. The authors note that the quality benchmark figure comes from the model card rather than their own testing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Perplexity open-sources SPACE, its sandbox platform for running AI agent code

Perplexity has released SPACE, the sandbox platform that has run its Computer agent's sessions since July, as open source under the Apache 2.0 license on GitHub. Each sandbox is a Firecracker microVM with its own operating system, managed by a central control plane that handles creating, pausing, resuming and removing them. Network access and credentials are kept outside the sandbox so agents can reach authorized services without storing keys in their workspace. Perplexity says the platform supports millions of sandbox creations daily and that creation ran 3 to 5 times faster than its previous provider. A prior security report found that while the virtual machines held up against escape attempts, four models bypassed the network egress policy in some runs, a weakness Perplexity says it has since fixed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Monte Carlo savings planner uses block bootstrap to model one-year market risk

DIVID.AI, which runs a web tool called DIVID Planner, describes how its one-year savings plan is built. Rather than compounding an average return, the model simulates 2,000 monthly market scenarios by resampling 21-day blocks from real price history, preserving how funds move together. Fixed seeds and quantile-based starting points keep plans stable when answers or data change. The user's income, bills, and random surprise expenses are then run through each path, with the emergency fund kept in savings. The founders stress that the output is an estimate from past prices rather than a forecast, and the tool is not financial advice.

0 comments Read more at DEV Community