Little did he know in 2026 you can feed that cartoon into AI and it will build you that app

It's a question from 2011...

S3: Simple Storage Service. It's a building block, and it's only natural other abstractions are built on top of it.

Agree it doesn't have to be part of S3 itself. My point is that there is a missing semantic layer.

In practice, many teams use S3 directly without any layer on top. So without better organizational capabilities, they can't keep track of what they have stored where, who created it, whether it is still used, etc.

And when teams do use a catalog, it's usually detached from the storage layer itself, so you can't easily view a dataset in the catalog and know how much it costs, who accessed it, and so on.

Have you seen better places that figured out a better way to handle this? Without a ton of custom tooling?

No but why doesn’t this object-storage-primitive accommodate all my specific requirements already?

They should also accommodate my need for all POSIX filesystem API’s included cheap-moves and renames!!!!!

/s

POSIX isn't the ask. Datasets are. The need to keep track of what data you have stored is universal, not my specific requirement.

I make the (glib) comment, because it’s a similar argument to the one that was popular a few years ago.

S3 is an object store. Treat it more like a KV store. As other comments have pointed out, the solution here is pick-your-favourite-metadata-store, be it Postgres, or what iceberg does, and other data on S3.

Why did it take them 4 days between publishing a CVE for the vulnerability (Dec 19th) and posting a public patch (Dec 23rd)?

Had their hands full getting sued the same day: https://news.ycombinator.com/item?id=46403128

Might not be how it appears. The CVE number can be reserved by the org and then "published" with only minimal info, then later update with full details. Looking at the meta data that's probably what happened here (not entirely sure what the update was though):

    {
    "cveId": "CVE-2025-14847",
    "assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
    "state": "PUBLISHED",
    "assignerShortName": "mongodb",
    "dateReserved": "2025-12-17T18:56:21.301Z",
    "datePublished": "2025-12-19T11:00:22.465Z",
    "dateUpdated": "2025-12-29T23:20:23.813Z"
    }

In the US, the last two weeks of December can be slow due to the holiday season. I wouldn’t be surprised if Mongo wasn’t as staffed as usual.

should've spun up a few more AI agents

That's a good question. I suppose that posting the commit makes it incredibly obvious how to exploit the issue, so maybe they wanted to wait a little bit longer for their on-prem users who were slow to patch?

Posting the CVE and then the patch is the reverse of this.

By "patch" I am talking about the public commit. Updated binaries were made available when the CVE was published.

That's not what the blog post implies given they only told people how to update aftwards.

You want to do evals, yeah.

If I place a grain of rice on the first square of a chess board and double the amount on each step, I'd have 18 quintillion grains of rice.

18 quintillion grains of rice? That is not going to happen.

Just for reference, 18 quintillion grains of rice is roughly 500 times the global production of rice in 2022.

We can, though? A sugar tax.

I have the same browser and versions as you and it plays on my phone. Pixel 7 Pro, if that matters.

Wild. I've checked all of my settings and I have video allowed to auto-play, I tried loading it in Destkop Mode, restarting, etc., and I still get nothing.

OP, great site, btw! I'd be glad test any settings on my phone and report back, if that'd help.

27 is just the EU. The whole of Europe is more like 50, which is even wilder!

Paywall