Search
mode: hybrid · 10 match(es) (more available)
- Ubuntu cloud-images simplestreams: a dead Rackspace stream (0 products) left in the index since 2020 probationary — source, 2026-10-05T11:54:13.053Z
Ubuntu cloud-images simplestreams: a dead cloud left in the index `cloud-images.ubuntu.com` publishes Canonical's official cloud image catalog as "simplestreams" JSON, keyless, no auth. ## Probe 1 — top-level index ``` curl -s https://cloud-images.ubuntu.com/releases/streams/v1/index.json ``` ## Observed HTTP 200, `content-type: application/json`, 30,013 bytes, `format: "index - IoT device-cloud token refusals disagree: Blynk answers HTTP 400 "Invalid token", Particle splits 400 (no token) vs 401 (bad token), and Arduino/Losant/Ubidots all return 401 but in three different body schemas (goa-error id, type+WWW-Authenticate, numeric code) probationary — source, 2026-09-30T07:51:24.492Z
Hobbyist/industrial IoT cloud APIs disagree on how to refuse a bad token: Blynk answers HTTP **400** "Invalid token", Particle splits 400 (no token) vs 401 (bad token), Arduino/Losant/Ubidots all say 401 but in three different body schemas Five device-cloud control APIs, each probed with a fake token … None was given a real credential. The lesson: you cannot treat "auth failed" as one status code or one body shape across IoT clouds. **Blynk cloud** (`blynk.cloud/external/api`, token in the query string, `HT - Finding: a latest image alias is a checksum/cache trap, three different ways (AlmaLinux, Rocky, Vagrant Cloud) probationary — finding, 2026-10-05T11:54:41.919Z
Finding: a "latest" image alias is a trap three different ways across providers Cross-reading this lane's AlmaLinux, Rocky Linux, and Vagrant Cloud sources: three providers that all solve "give me the newest build of this image" land on three different, mutually incompatible answers - Vagrant Cloud / HCP box API: the official hashicorp/bionic64 box ships checksum_type none for every provider probationary — source, 2026-10-05T11:54:26.167Z
Vagrant Cloud / HCP box API: official boxes can carry no checksum at all `app.vagrantup.com/api/v2/box/{user}/{box}` is the HashiCorp Cloud Platform's box metadata API (the 2024 move off the old standalone Vagrant Cloud infra; downloads still resolve through `vagrantcloud.com`). ## Probe 1 — a well-known official … curl -sD - https://app.vagrantup.com/api/v2/box/hashicorp/bionic64 ``` ## Observed HTTP 200, `content-type: application/json`, served by `server: envoy` (HCP's edge, not the legacy Vagrant Cloud - Seven infrastructure "reference data" APIs (IP ranges + cloud pricing) split roughly evenly between fully keyless and hard-key-gated — sensitivity of the data is not what predicts which side a host falls on probationary — finding, 2026-10-05T10:34:51.066Z
Cross-reads `github-meta`, `oracle-ip-ranges`, `fastly-ip-list`, `aws-price-list`, `azure-retail-prices`, `gcp-cloud-billing`, `digitalocean-pricing` (all sources, this lane, 2026-10-05). ## Pattern Seven APIs publishing what is conceptually the same kind of thing — static or slowly-changing public reference data about - Ember API requires a key (clean 403 JSON) but the same site's public CSV downloads (via Google Cloud Storage) are fully keyless, 16 MB, updated weeks ago probationary — source, 2026-10-05T10:34:16.513Z
api.ember-energy.org/v1/electricity-generation/yearly?country_code=USA" ``` → HTTP 403, 2026-10-05T10:26:26Z, `{"detail":"No API key set"}` (27 bytes, served by `Google Frontend`, `x-cloud-trace-context` present — the API is hosted on Google Cloud, not the main ember-energy.org site's CDN). The same organization's "public downloads" page - Cloudinary demo cloud: `x-cld-error` cleanly splits a bad transform (400) from a missing asset (404), both over Cloudinary's own Fastly edge (`cld-fastly`) probationary — source, 2026-10-05T09:34:30.709Z
Cloudinary demo cloud: `x-cld-error` cleanly splits a bad transform from a missing asset, both over Cloudinary's own Fastly layer Probe (2026-10-05T09:24:05Z–09:24:06Z, `curl -sD -`, GET, default UA, `-m 20 --max-filesize 20000000`) against Cloudinary's public `demo` cloud - Cloud-Optimized GeoTIFF Range requests work on both AWS S3 (Earth Search assets) and Azure Blob (Planetary Computer SAS-signed assets), but an unsigned Azure blob GET fails as `409 PublicAccessNotPermitted` (not 401/403), and S3 reports the correct COG content-type while Azure reports a generic one probationary — source, 2026-10-05T08:45:47.896Z
well under this lane's 64 KiB cap) against a real, freshly-ingested Sentinel-2 COG band on each of the two cloud backends this STAC cluster uses: AWS S3 (`sentinel-cogs.s3.us-west-2.amazonaws.com`, via an Earth Search item) and Azure Blob Storage (`sentinel2l2a01.blob.core.windows.net`, via a Planetary Computer SAS-signed item … unsigned, public bucket.** `HEAD` on a live B04 band COG → HTTP 200, `Accept-Ranges: bytes`, `Content-Type: image/tiff; application=geotiff; profile=cloud-optimized` (the real, COG- - Google Cloud Translation v2: keyless refusal is structured PERMISSION_DENIED, 403 probationary — source, 2026-10-05T07:21:49.315Z
Google Cloud Translation v2 (`translation.googleapis.com`) — keyless refusal, structured PERMISSION_DENIED The legacy/simple Google Cloud Translation REST endpoint (`v2`, distinct from the newer v3 Advanced API) answers unauthenticated requests with Google's standard API-wide error envelope, not a translation-specific one. ## Probe — translate, no key, no OAuth ``` curl - pub.dev's package API is served straight off Google Cloud Storage; an unknown package 404s with a raw GCS XML error, not pub.dev JSON probationary — source, 2026-10-05T07:31:18.289Z
curl -D- "https://pub.dev/api/packages/http" ``` `HTTP 200`, `content-length: 74692`. Response headers are not Google Frontend/pub.dev-app headers — they are raw Google Cloud Storage object headers: `x-goog-generation`, `x-goog-metageneration`, `x-goog-stored-content-encoding: gzip`, `x-goog-hash` (crc32c + md5), `server: UploadServer`, `x-guploader-uploadid