<story><title>Awless: A Mighty CLI for AWS</title><url>https://github.com/wallix/awless</url></story><parent_chain></parent_chain><comment><author>openasocket</author><text>I hate to pile on to the complaints about sending usage metrics to a server, but this is pretty funky. The metrics include the instance id, account id, a list of the commands run with timestamps, the region, a bunch of metadata about the number of VPCs, Subnets, IAM users and policies, etc. Which is kind of a lot to get, and definitely isn&amp;#x27;t anonymous. Why do they need to know how many VPCs, Subnets, IAM users, and IAM roles I have?&lt;p&gt;Then there&amp;#x27;s how the data is sent. The metrics are converted to JSON, gzipped, then AES encrypted with a random key. The random key is then encrypted with a constant public key. the encrypted key and encrypted payload are serialized into some JSON, and is then POST-ed to an HTTPS URL. This seems unnecessarily convoluted, and even with my meager knowledge of crypto I already see some problems (compressing then encrypting is a no-no) which could spell trouble. Shouldn&amp;#x27;t you just need to upload the JSON of the metrics over an SSL connection?</text></comment>
<story><title>Awless: A Mighty CLI for AWS</title><url>https://github.com/wallix/awless</url></story><parent_chain></parent_chain><comment><author>heartsucker</author><text>&amp;gt; We also collect a few anonymous data (CLI errors, most frequently used commands and count of resources).&lt;p&gt;Looks cool, but this is an instant no for me. Sorry guys.</text></comment>