第十五封信:自助服务,降低门槛

第十五封信中英文对照:

To our shareowners:

致我们的股东:

The Power of Invention

发明的力量

“To us, the value of Amazon Web Services is undeniable – in twenty seconds, we can double our server capacity. In a high-growth environment like ours and with a small team of developers, it’s very important for us to trust that we have the best support to give to the music community around the world. Five years ago, we would have crashed and been down without knowing when we would be back. Now, because of Amazon’s continued innovation, we can provide the best technology and continue to grow.” That’s Christopher Tholen, the Chief Technology Officer of BandPage. His comments about how AWS helps with the critical need to scale compute capacity quickly and reliably are not hypothetical: BandPage now helps 500,000 bands and artists connect with tens of millions of fans.

「对我们来说,没有人可以否定AWS的高价值。20秒内,我们就能将服务器的容量提高一倍。我们的增长速度极快,且仅有为数不多的开发人员。我们相信Amazon的服务可以提供全世界的音乐社群最好支持。5年前,我们的服务器早就该崩溃倒下。然而,在Amazon的不断创新之下,我们现在可以提供全世界最好的技术,并不断发展。」BandPage的首席技术官Christopher Tholen对此给出以下评论:Amazon提升计算能力的速度之快、技术之稳定并不是空谈,有了AWS的技术支持,BandPage现在可以帮助50万个乐团和艺术家与他们的千万粉丝建立联系。

“So, I started selling on Amazon in April of 2011, and by the time we became the top Amazon lunchbox seller in June, we had between 50 and 75 orders a day. When we hit August and September – our busiest time, with the start of the school year – we had 300, sometimes 500 orders a day. It was just phenomenal… I’m using Amazon to fulfill my orders, which makes my life easier. Plus, when my customers found out they could get free shipping with Prime subscriptions, the lunchboxes began selling like crazy.” Kelly Lester is the “mom entrepreneur” of EasyLunchboxes, her own innovative line of easy-to-pack, environmentally friendly lunchbox containers.

「因此,我在2011年4月开始在Amazon上贩卖商品。当我们在6月成为Amazon最畅销的便当盒卖家时,我们一天能有50到75笔订单。我们最忙碌的月份8月和9月,也就是学校开学的月份,一天能卖出300笔订单,有时甚至能达到500笔。这是十分了不起的……我一直都在使用Amazon的服务来配送商品,这为我的生活减轻许多麻烦。另外,当我的客户发现他们可以用Prime服务买到免运的商品后,订单数开始暴增」EasyLunchboxes的「妈妈企业家」Kelly Lester如此说道。EasyLunchboxes是她自己的创新商品,特色是易于包装且环保。

“I sort of stumbled onto it, and it opened a whole new world for me. Since I had over a thousand [book] titles at my house, I thought, ‘I’ll give this a try.’ I sold some and I kept expanding it and expanding it, and come to find out this was so much fun I decided I don’t ever want to get another job again. And I’ve got no boss – other than my wife, that is. What could be better than that? We actually work together on this. We both go out hunting, so it’s a team effort that’s worked out very well. We sell about 700 books a month. We ship between 800 and 900 to Amazon each month and Amazon ships out the 700 that people buy. Without Amazon handling shipping and customer service, my wife and I would have to be running to the post office or someplace every day with dozens of packages. With that part taken care of for us, life is much simpler… This is a terrific program and I love it. After all, Amazon supplies the customers and even ships the books. I mean, how can it get better than that?” Bob Frank founded RJF Books and More after getting laid off in the midst of the economic downturn. He and his wife split their time between Phoenix and Minneapolis, and he describes finding the books he sells like “a treasure hunt every day.”

「我偶然发现Amazon,结果它为我打开了一个新的世界。由于我家里有上千本书,所以我想试着在Amazon上卖点书。我卖了一些书,然后不断扩张业务。接着,我发现这实在太有趣了,我决定不再寻找其他工作,专职做这项业务。没有老板,而且可以和妻子一起工作,有什么工作比这个工作更好呢?我们为此一起努力,外出寻宝找书,团队合作非常顺利。我们每个月向Amazon寄出800至900本书,可卖出其中约700本书,并由Amazon帮我们处理物流。没有Amazon的物流及客服服务,我和我的妻子需要每天扛着几十个包裹到快递收件中心寄货。有了这些服务,我们的生活变得更加简单。这是相当了不起的服务,我非常喜欢。毕竟,Amazon除了帮助我们销售,还帮我们处理物流,还有什么比这个服务更好?」在经济不景气中被裁员之后,Bob Frank创立了RJF Book。他和妻子花时间在凤凰城和明尼阿波利斯之间寻找书籍,他将这样的过程称之为「每日寻宝」。

“Because of Kindle Direct Publishing, I earn more royalties in one month than I ever did in a year of writing for a traditional house. I have gone from worrying about if I will be able to pay the bills – and there were many months when I couldn’t – to finally having real savings, even thinking about a vacation; something I haven’t done in years… Amazon has allowed me to really spread my wings. Prior, I was boxed into a genre, yet I had all of these other books I wanted to write. Now I can do just that. I manage my career. I feel as if I finally have a partner in Amazon. They understand this business and have changed the face of publishing for the good of the writer and the reader, putting choices back into our hands.” That’s A. K. Alexander, author of Daddy’s Home, one of the top 100 best-selling Kindle books in March.

「由于使用了Kindle自助出版(Kindle Direct Publishing),我在一个月内获得的版税比为传统出版社写作一年还多。过去我经常担心收入是否能支付生活开支,但现在我不用担心了。我开始有了积蓄,甚至考虑给自己放个假,假期可是我好几年想都不敢想的事。Amazon让我能够真正展翅高飞。以前,虽然我想写很多类型的书,但我往往会被出版社定型成特定类型的作家。现在,我可以写各种我想写的类型的书。我管理自己的事业,我感觉自己在Amazon中有合作伙伴。他们了解这项业务,并为作家和读者的利益改变了出版业的面貌,将选择权重新交到我们手上。」 《Daddy’s Home》是三月份最畅销的Kindle电子书之一,它的作者A. K. Alexander如此说道。

“I had no idea that March of 2010, the first month I decided to publish on KDP, would be a defining moment in my life. Within a year of doing so, I was making enough on a monthly basis to quit my day job and focus on writing full time! The rewards that have sprung out of deciding to publish through KDP have been nothing short of life changing. Financially. Personally. Emotionally. Creatively. The ability to write full time, to be home with my family, and to write exactly what I want without the input of a legacy publisher marketing committee wanting to have a say in every detail of my writing, has made me a stronger writer, a more prolific writer, and most importantly a far happier one…. Amazon and KDP are literally enabling creativity in the publishing world and giving writers like me a shot at their dream, and for that I am forever grateful.” That’s Blake Crouch, author of several thrillers, including the Kindle best seller Run.

「2010年3月,也是我使用Kindle自助出版的第一年,我当时并不知道,这将成为我生活的决定性时刻。在不到一年的时间里,我每个月都能够赚到足够的钱,让我能够辞掉工作,全职投入写作!使用Kindle自助出版服务的这个决定,大大的改变了我的生活,无论是从财务层面、个人层面、情感层面还是创意层面。能够全职写作、和家人更多的相处时间、没有传统出版商对细节的控制、写我想写的内容,这些使我成为一个更优秀、更多产、更快乐的作家。Amazon自助出版服务确实使出版界更能发挥创造力,并为像我这样的作家提供了实现梦想的机会,对此我非常感激。」Kindle畅销电子书《Run》及多本惊悚小说的作者Blake Crouch如此说道。

“Amazon has made it possible for authors like me to get their work in front of readers and has changed my life. In a little over a year, I have sold nearly 250,000 books through the Kindle and have traded in old dreams for bigger and better ones. Four of my books have hit the Top 100 Kindle Best Sellers List. Also, I have been approached by agents, foreign sales people, and two movie producers, and have received mentions in the LA Times, Wall Street Journal, and PC Magazine, and was recently interviewed by USA Today. Mostly, I am excited that all writers now have the opportunity to get their work in front of readers without jumping through insurmountable hoops. Writers have more options and readers have more choices. The publishing world is changing fast, and I plan to enjoy every minute of the ride.” Theresa Ragan is the KDP author of multiple Kindle best sellers including Abducted.

「Amazon让我这样的作家有机会在读者面前展示作品,改变了我的生活。在一年多的时间内,我透过Kindle售出近25万本书,用旧的梦想交换更大的新梦想。我有四本书进入Kindle畅销排行榜100名,代理商、国外销售人员和两个电影制片人和我联系合作事宜,《LA Times》、《Wall Street Journal》和《PC Magazine》对我进行介绍,而我最近还接受了《USA Today》的采访。让我感到兴奋的是,此时此刻任何作家都有机会在读者面前展示自己的作品。作家有了更多选择,读者也是。出版界瞬息万变,我享受每一分钟的旅程。」《Abducted》等多本Kindle畅销书作者Theresa Ragan如此说道。

“Past age 60 and in the midst of the recession, my wife and I found our income options severely limited. KDP was my one shot at a lifelong dream – our only chance at financial salvation. Within months of publishing, KDP has completely changed our lives, enabling this aging nonfiction writer to launch a brand-new career as a best-selling novelist. I can’t say enough on behalf of Amazon and the many tools that they make available to independent authors. Without reservation, I urge fellow writers to investigate and seize the opportunities that KDP offers. As I’ve happily discovered, there is zero downside risk – and the potential is virtually unlimited.” Robert Bidinotto is the author of the Kindle best seller Hunter: A Thriller.

「在经济衰退期间,我和我的妻子发现自己的收入来源选项很有限,此时我们已经60岁了。Kindle自助出版是我对毕生梦想的一次尝试-我们仅有的财务机遇。出版后几个月内,Kindle自助出版大大改变了我的生活,使一名年迈的非小说家,可以用新的身分-畅销小说作者重新开始。我并不能充分代表Amazon,他们为独立工作者提供很多工具。我毫无保留地鼓励其他作家研究Kindel自助出版,好好保握Amazon提供的机遇。我很高兴地发现,风险为零而潜力几乎无限。」Kindle畅销书《Hunter: A Triller》的作者Robert Bidinotto如此说道。

“I leveraged KDP’s technology to blow through all the traditional gatekeepers. Can you imagine how that feels, after struggling so hard, for so long, for every … single … reader? Now, inspirational fiction lovers I never would have reached are enjoying Nobody and my other two novels from the Kindle Store at $2.99. I’ve always wanted to write a Cinderella story. Now I have. And, thanks to Prince Charming (KDP), there will be more to come…” Creston Mapes is the author of the Kindle best seller Nobody.

「我利用Kindle自助出版,突破了所有传统出版业的桎梏。你能想象那种十分坚持才能得到一个又一个读者的感受吗?现在,我从未接触过的读者,正以2.99美元享受我所创作的小说。我一直希望能够写个像《灰姑娘》的故事,现在我实现了。感谢我的白马王子-Kindle自助出版,将来还会有更多好故事。」Kindle畅销书《Nobody》作者Creston Mapes如此说道。

Invention comes in many forms and at many scales. The most radical and transformative of inventions are often those that empower others to unleash their creativity – to pursue their dreams. That’s a big part of what’s going on with Amazon Web Services, Fulfillment by Amazon, and Kindle Direct Publishing. With AWS, FBA, and KDP, we are creating powerful self-service platforms that allow thousands of people to boldly experiment and accomplish things that would otherwise be impossible or impractical. These innovative, large-scale platforms are not zero-sum – they create win-win situations and create significant value for developers, entrepreneurs, customers, authors, and readers.

发明总是以多种形式、不同规模出现。其中,最激进且最具变革性的莫过于那些鼓励他人释放创造力、追求梦想的发明。AWS、Amazon物流和Kindle自助出版正是这样的发明。有了他们,我们正在创建一个强大的自助平台,让上千上万的人们可以大胆尝试,并完成原本不可能的事情。这些创新的大规模平台所开创的并非是一方有所得,他方必有所失的零和游戏,而是双赢局面,为开发者、企业家、消费者、作家和读者产生巨大价值。

Amazon Web Services has grown to have thirty different services and thousands of large and small businesses and individual developers as customers. One of the first AWS offerings, the Simple Storage Service, or S3, now holds over 900 billion data objects, with more than a billion new objects being added every day. S3 routinely handles more than 500,000 transactions per second and has peaked at close to a million transactions per second. All AWS services are pay-as-you-go and radically transform capital expense into a variable cost. AWS is self-service: you don’t need to negotiate a contract or engage with a salesperson – you can just read the online documentation and get started. AWS services are elastic – they easily scale up and easily scale down.

AWS已经发展成30种不同服务,客户包括成千上万个大小企业及个人开发者。AWS的首批产品之一,Simple Storage Service目前有超过9000亿个数据对象,每天还会增加超过10亿个数据对象。一般来说,Simple Storage Service每秒处理超过50万笔交易,峰值可达100万笔交易。所有AWS服务都是「随收随付制(pay-as-you-go)」,用多少才收多少,客户因此可以将固定的服务器支出,转为可变动成本。AWS是自助服务:你不需要和销售人员签订合约,只需要阅读在线文件之后,就可以开始使用。AWS服务有很大的弹性,可以轻松调整使用容量。

In just the last quarter of 2011, Fulfillment by Amazon shipped tens of millions of items on behalf of sellers. When sellers use FBA, their items become eligible for Amazon Prime, for Super Saver Shipping, and for Amazon returns processing and customer service. FBA is self-service and comes with an easy-to-use inventory management console as part of Amazon Seller Central. For the more technically inclined, it also comes with a set of APIs so that you can use our global fulfillment center network like a giant computer peripheral.

2011年的最后一个季度,Amazon配送服务为卖家们运送了数千万件商品。当卖家使用Amazon配送服务时,他们的商品可以搭配Prime会员服务、Super Saver Shipping和Amazon客服支持。Amazon配送服务是易于使用的自助服务,而且是库存管理后台(Amazon Seller Central)的重要组成。对于更倾向技术的使用者,它还提供了一组API,让使用者可以像使用大型计算器外围设备一样,使用我们的全球配送中心网络。

I am emphasizing the self-service nature of these platforms because it’s important for a reason I think is somewhat non-obvious: even well-meaning gatekeepers slow innovation. When a platform is self-service, even the improbable ideas can get tried, because there’s no expert gatekeeper ready to say “that will never work!” And guess what – many of those improbable ideas do work, and society is the beneficiary of that diversity.

我要再次强调这些平台的「自助服务」特性,因为我认为它容易被忽略,但却非常重要。即使是立意良好的管制,也会降低创新的速度。当一个平台的服务是自助式的,客户有什么新想法就可以立即尝试,因为没有人会跳出来说「别那么做!那行不通!」很多看似不可能的想法最后确实起作用,最终整个社会从这些点子中受益匪浅。

Kindle Direct Publishing has quickly taken on astonishing scale – more than a thousand KDP authors now each sell more than a thousand copies a month, some have already reached hundreds of thousands of sales, and two have already joined the Kindle Million Club. KDP is a big win for authors. Authors who use KDP get to keep their copyrights, keep their derivative rights, get to publish on their schedule – a typical delay in traditional publishing can be a year or more from the time the book is finished – and … saving the best for last … KDP authors can get paid royalties of 70%. The largest traditional publishers pay royalties of only 17.5% on ebooks (they pay 25% of 70% of the selling price which works out to be 17.5% of the selling price). The KDP royalty structure is completely transformative for authors. A typical selling price for a KDP book is a reader-friendly $2.99 – authors get approximately $2 of that! With the legacy royalty of 17.5%, the selling price would have to be $11.43 to yield the same $2 per unit royalty. I assure you that authors sell many, many more copies at $2.99 than they would at $11.43.

Kindle自助出版一推出之后,很快就发展到令人惊讶的规模-如今有上千名作家每月卖出超过1000册书籍,其中有两名作家甚至达到Kindle百万销量俱乐部。Kindle自助出版能大大帮助作者,作者可以透过它保有版权及衍生权利,可以在书籍完成后就计划出版,不用像传统出版一样等上一段时间。最有价值的是,使用Kindle自助出版的作者可以拿到70%版税。最大型的传统出版商只给电子书作者17.5%版税(70%版税再25%)。Kindle自助出版的版税计算方式对作者来说是非常创新的。一般来说,一本Kindle电子书的售价是2.99美元,其中作者大约可以得到2美元。以传统出版商17.5%版税的方式来计算,作者想要得到同样的2美元收入,需要卖掉的是一本定价高达11.43美元的书。我跟你保证,作者以较低的2.99美元价格销售,可以卖掉更多册书籍。

Kindle Direct Publishing is good for readers because they get lower prices, but perhaps just as important, readers also get access to more diversity since authors that might have been rejected by establishment publishing channels now get their chance in the marketplace. You can get a pretty good window into this. Take a look at the Kindle best-seller list, and compare it to the New York Times best-seller list – which is more diverse? The Kindle list is chock-full of books from small presses and self-published authors, while the New York Times list is dominated by successful and established authors.

Kindle自助出版对于读者来说也有好处,他们可以得到更便宜的书籍,以及更重要的是,还有更多样化的书籍,因为那些可能会被出版社拒绝的书籍,现在都有机会被出版,并且很容易被你找到。看一下Kindle的畅销排行榜你就会发现,与《New York Times》的畅销排行榜相比,Kindle的排行榜内容多样性比较高。Kindle的排行榜中挤满了小型出版社和自费出版的书籍,而《New York Times》的排行榜则以知名作家的著作为主。

Amazonians are leaning into the future, with radical and transformational innovations that create value for thousands of authors, entrepreneurs, and developers. Invention has become second nature at Amazon, and in my view the team’s pace of innovation is even accelerating – I can assure you it’s very energizing. I’m extremely proud of the whole team, and feel lucky to have a front row seat.

Amazon人正以崭新的、变革性的创新迈向未来,为成千上万的作家、企业家、开发者创造价值。创新已经成为Amazon的第二天性,团队的创新脚步越来越快。我可以向你保证,我们正踩着充满活力的步伐。我对于整个团队的表现感到十分自豪,拥有这个团队的前排座位我感到十分幸运。

As always, I attach a copy of our original 1997 letter. Our approach remains the same, and it’s still Day 1!

如同往常,我把我们在1997年写的致股东信附在文末。我们的价值观依然不变,今天依旧是Day 1。

Jeffrey P. Bezos

Founder and Chief Executive Officer

Amazon.com, Inc.

杰夫·贝索斯

Amazon创始人暨CEO

我的观点

今年的信,讲了很多的用户故事。包括一个AWS客户的,一个亚马逊物流的和N个Kindle自出版业务。

这些都是一些成功案例,是帮助别人成功的案例。因为亚马逊很多的自助服务,客户可以不受限制的使用这些服务。 所以,客户有什么样的想法就可以去试试,没有限制。这能让客户成功。

其实自主属性是非常好的,这可以给客户无限制的服务,不限制客户的想法。想想,在没有云服务的时候,做一个网站,做个App会有多难。 云计算的发展,让很多时候都没有了门槛。包括亚马逊举的物流的例子和卖货的例子。 以前你想开点是很困难,现在在淘宝,亚马逊可能十分钟就可以有一个店铺,还提供了更多非常方便的服务,创业的门槛降得很低了。

这么看,其实国内的很多制度限制了创新的发展。

第十四封信:大力投入技术研发,为顾客服务

第十四封信中英文对照:

To our shareowners:

致我们的股东:

Random forests, naïve Bayesian estimators, RESTful services, gossip protocols, eventual consistency, data sharding, anti-entropy, Byzantine quorum, erasure coding, vector clocks … walk into certain Amazon meetings, and you may momentarily think you’ve stumbled into a computer science lecture.

随机森林(Random Forest)、朴素贝叶斯分类器(Naïve Bayesian Estimator)、表现层状态转换(RESTful Service)、Gossip Protocol、最终一致性(Eventual Consistency)、Data Sharding、逆熵(Anti-Entropy)、Byzantine Quorum、抹除码(Erasure Code)、向量时钟 (Vector Clock),走进某个Amazon会议中,你可能会以为自己走进某个计算器科学讲座。

Look inside a current textbook on software architecture, and you’ll find few patterns that we don’t apply at Amazon. We use high-performance transactions systems, complex rendering and object caching, workflow and queuing systems, business intelligence and data analytics, machine learning and pattern recognition, neural networks and probabilistic decision making, and a wide variety of other techniques. And while many of our systems are based on the latest in computer science research, this often hasn’t been sufficient: our architects and engineers have had to advance research in directions that no academic had yet taken. Many of the problems we face have no textbook solutions, and so we — happily — invent new approaches.

摊开一本最新的软件架构教科书,你会发现我们用上里头不少知识。我们使用了高性能的交易系统、Complex Rendering、Object Caching、工作流和排队系统、商业智能、数据分析、机器学习、模式识别、神经网络、概率决策以及其他多种技术。尽管我们很多系统都用上了最新的计算器科学研究,这依然还是不够。我们的架构师和工程师,不得不朝学术界的未知领域拓展技术边界。我们面临的很多问题,教科书上都没有答案。因此,我们乐于发明新方法。

Our technologies are almost exclusively implemented as services: bits of logic that encapsulate the data they operate on and provide hardened interfaces as the only way to access their functionality. This approach reduces side effects and allows services to evolve at their own pace without impacting the other components of the overall system. Service-oriented architecture — or SOA — is the fundamental building abstraction for Amazon technologies. Thanks to a thoughtful and far-sighted team of engineers and architects, this approach was applied at Amazon long before SOA became a buzzword in the industry. Our e-commerce platform is composed of a federation of hundreds of software services that work in concert to deliver functionality ranging from recommendations to order fulfillment to inventory tracking. For example, to construct a product detail page for a customer visiting Amazon.com, our software calls on between 200 and 300 services to present a highly personalized experience for that customer.

我们的技术几乎都是用服务的形式呈现:逻辑位封装了操作数据,并强化存取功能的接口。这样的做法降低了副作用,同时让服务以既有的步调迭代,而不影响系统的其他组件。服务导向架构(Service-Oriented Architecture)是Amazon的技术基石。感谢我们极富远见的工程师与架构师团队,我们在服务导向架构一词尚未成为业界流行语时就开始这么做了。我们的电子商务平台,由数百个联合工作的软件服务组成,以提供客户从推荐、订单执行到库存追踪的功能。举个例子,为了在产品详情页上提供客户个人化的推荐,我们的软件需要调用200到300个服务。

State management is the heart of any system that needs to grow to very large size. Many years ago, Amazon’s requirements reached a point where many of our systems could no longer be served by any commercial solution: our key data services store many petabytes of data and handle millions of requests per second. To meet these demanding and unusual requirements, we’ve developed several alternative, purpose-built persistence solutions, including our own key-value store and single table store. To do so, we’ve leaned heavily on the core principles from the distributed systems and database research communities and invented from there. The storage systems we’ve pioneered demonstrate extreme scalability while maintaining tight control over performance, availability, and cost. To achieve their ultra-scale properties these systems take a novel approach to data update management: by relaxing the synchronization requirements of updates that need to be disseminated to large numbers of replicas, these systems are able to survive under the harshest performance and availability conditions. These implementations are based on the concept of eventual consistency. The advances in data management developed by Amazon engineers have been the starting point for the architectures underneath the cloud storage and data management services offered by Amazon Web Services (AWS). For example, our Simple Storage Service, Elastic Block Store, and SimpleDB all derive their basic architecture from unique Amazon technologies.

任何一个打算增长到极大规模的系统,其系统的核心都是状态管理。很多年前,Amazon就达到一个很大的规模,当时市面上的所有解决方案都无法满足我们的需求:我们的服务储存了好几PB的数据,每秒处理了上百万个请求。为了满足这些非同寻常的需求,我们开发出数个长期解决方案,包括我们自己的键-值数据库(Key-Value Store)和单表数据库(Single Table Store)。为此,我们以分布式系统及数据库的核心原理为基础进行发明创造。我们首创的数据库系统,展示出极高的可扩展性,同时保持了对性能、可用性和成本的良好平衡。为了实现超大规模的效能,这些系统采用了一种新办法来管理数据更新:降低同时发送大量副本的更新需求,使系统可以撑过高强度的挑战。这些做法都是为了同一个最终目标-数据同步。Amazon工程师开发的数据管理服务,已经成为AWS云计算服务的基础架构。举个例子,我们的Simple Storage Service、Elastic Block Store和SimpleDB服务,其基础架构都来自于Amazon的独家技术。

Other areas of Amazon’s business face similarly complex data processing and decision problems, such as product data ingestion and categorization, demand forecasting, inventory allocation, and fraud detection. Rulebased systems can be used successfully, but they can be hard to maintain and can become brittle over time. In many cases, advanced machine learning techniques provide more accurate classification and can self-heal to adapt to changing conditions. For example, our search engine employs data mining and machine learning algorithms that run in the background to build topic models, and we apply information extraction algorithms to identify attributes and extract entities from unstructured descriptions, allowing customers to narrow their searches and quickly find the desired product. We consider a large number of factors in search relevance to predict the probability of a customer’s interest and optimize the ranking of results. The diversity of products demands that we employ modern regression techniques like trained random forests of decision trees to flexibly incorporate thousands of product attributes at rank time. The end result of all this behind-the-scenes software? Fast, accurate search results that help you find what you want.

Amazon的各个业务领域也遇到类似的数据处理和决策问题,像是产品数据的采集与分类、需求预测、库存分配和诈欺预防。起初,建立于规则之上的系统可以很好地运行,但随着时间的推移,系统会越来越脆弱,越来越难以维持。在很多情况下,先进的机器学习可以提供更精准的分类,而且可以自我修复,以适应复杂多变的情况。举个例子,我们的搜索引擎使用数据挖掘和机器学习算法来建构模型,运用信息提取算法标识属性,从非结构化的描述中提取信息。如此一来,消费者可以缩小搜寻范围,快速找到所需产品。我们在相关性中考虑了很多因素,因此我们的搜寻功能可以预测消费者的兴趣,并优化搜寻结果的排行。商品的多样性,使我们必须采用现代回归技术,例如随机森林,让上千种商品属性可以灵活地排行。所有这些幕后努力换得什么?快速且精准的搜寻结果,帮助你找到你要的东西。

All the effort we put into technology might not matter that much if we kept technology off to the side in some sort of R&D department, but we don’t take that approach. Technology infuses all of our teams, all of our processes, our decision-making, and our approach to innovation in each of our businesses. It is deeply integrated into everything we do.

如果我们单纯将技术只放在研发部门,那我们迄今的努力可能没有什么效益。因此,我们并不是这么做的。技术为我们的团队、流程、决策和业务创新注入活力,技术与我们所做的一切紧密结合。

One example is Whispersync, our Kindle service designed to ensure that everywhere you go, no matter what devices you have with you, you can access your reading library and all of your highlights, notes, and bookmarks, all in sync across your Kindle devices and mobile apps. The technical challenge is making this a reality for millions of Kindle owners, with hundreds of millions of books, and hundreds of device types, living in over 100 countries around the world—at 24×7 reliability. At the heart of Whispersync is an eventually consistent replicated data store, with application defined conflict resolution that must and can deal with device isolation lasting weeks or longer. As a Kindle customer, of course, we hide all this technology from you. So when you open your Kindle, it’s in sync and on the right page. To paraphrase Arthur C. Clarke, like any sufficiently advanced technology, it’s indistinguishable from magic.

Kindle的Whispersync技术就是一个很好的例子。无论你在哪里,手里拿着什么装置,你都可以透过Kindle和移动应用,存取你的阅读纪录、重点集锦、笔记和书签。我们遇到的技术挑战是,提供一天24小时全年无休的服务,让遍及全球的用户可以在上百种装置中随时取得数以亿计的书籍。Whispersync的核心是数据同步技术,它可以解决装置多周不联网后,数据同步时会遇到的冲突问题。当然,作为Kindle的用户,你不用也不需要知道这些繁复的技术细节。当你打开Kindle之后,它会出现在右侧进行同步。用英国科幻作家Clarke的话来说就是,先进的科技和魔术没什么区别。

Now, if the eyes of some shareowners dutifully reading this letter are by this point glazing over, I will awaken you by pointing out that, in my opinion, these techniques are not idly pursued – they lead directly to free cash flow.

如果你们之中的有些人,读到这里时感到茫然,不知道追求技术的意义何在,那就由我来揭示技术的价值。这些技术不是全然盲目的追求,技术和自由现金流是直接相关的。

We live in an era of extraordinary increases in available bandwidth, disk space, and processing power, all of which continue to get cheap fast. We have on our team some of the most sophisticated technologists in the world – helping to solve challenges that are right on the edge of what’s possible today. As I’ve discussed many times before, we have unshakeable conviction that the long-term interests of shareowners are perfectly aligned with the interests of customers.

我们生活在一个带宽增加、硬盘空间增加和处理能力增加的美好时代,而且他们会持续越来越快、越来越便宜。我们团队中有世界上最好的技术人员,帮助我们解决现今遇到的挑战。如同我之前多次讨论过的,我们坚信,股东的长期利益与客户的利益完全一致。

And we like it that way. Invention is in our DNA and technology is the fundamental tool we wield to evolve and improve every aspect of the experience we provide our customers. We still have a lot to learn, and I expect and hope we’ll continue to have so much fun learning it. I take great pride in being part of this team.

我们喜欢如此。发明存在于我们的DNA,技术是我们的发展和改善客户体验的基本工具。我们还有很多东西要学,我希望我们持续享受从中学习的乐趣。对于身为团队的一份子,我感到很骄傲。

As always, I attach a copy of our original 1997 letter. Our approach remains the same, and it’s still Day 1.

如同往常,我把我们在1997年写的致股东信附在文末。我们的价值观依然不变,今天依旧是Day 1。

Jeffrey P. Bezos

Founder and Chief Executive Officer

Amazon.com, Inc.

杰夫·贝索斯

Amazon创始人暨CEO

我的观点

这封信里面提到了很多技术名词,大部分我还是有了解过,这其实很多就是亚马逊提出来的。说到亚马逊,其实很多人会提到他的推荐系统。

是的,我还是喜欢里面的那句话,英国科幻大师Clarke曾说过:「在任何一项足够先进的技术和魔法之间,人们看不出有何区别。」

亚马逊为了支撑业务,对技术进程了大量的投入研究,发明了很多东西。贝索斯说,他们乐于发明新方法,这其实是非常好的现象。技术为我们的团队、流程、决策和业务创新注入活力,技术与我们所做的一切紧密结合。其实就证明亚马逊很看重技术,也乐于投入来进行技术研究。

其实,就以前亚马逊的口碑来说,Google才是那个被证明技术能力很强的公司,亚马逊经常从开源社区吸血,而且还不参与贡献,这是开源届的毒瘤。 后面这几年,观感才好一点。

漏洞挖掘365天挑战——Day020:Recon之基于范围的自动化(1)

侦察的重要性

当你去做漏洞挖掘的时候,你需要收集目标的一些信息。有人认为侦察就是一种自动化的发现漏洞的方式,其实不是。

侦察更多的是让你有一个更好的攻击面,让你有更多的攻击机会,发现潜在的漏洞。

自动化是侦察的一个方向,但是要明确,手动分析也非常的重要。

下面,将用三篇文章来介绍基于范围的侦察。

三篇文章以下面的思维导图为基础,介绍最小的范围,中等范围和最大范围侦察。

基于范围的侦察方法

基于范围,顾名思义就是基于作用域进行划分的侦察方法。你有的时候,目标范围过大,有的时候就是一个单一的目标,进行全部的侦察,你没那么多的精力,也非常耗时,这个时候基于范围的侦察就有效了。

它主要:

  1. 节约时间
  2. 你知道要找什么
  3. 自动化侦察
  4. 找到的漏洞很少出现在范围外
  5. 有更好的侦察结果

小范围侦察

目标: 寻找单个应用的URL,登录后台/非生产环境/测试环境等

内容发现

目标枚举,重点是需要一个好的字典

工具列表:

网站指纹

检查应用运行的服务,通常使用的服务器,库和第三方组件可能 过时,存在已知的安全问题

工具列表:

  • Wappalyzer Plugin
  • Whatweb

CVE跟踪

检查应用过时的软件和库的CVEs

网站:

端口扫描

执行端口扫描是有用的,因为你有的时候会得到一些有趣的端口,这些端口还运行着一些服务。这些服务可能有默认密码,配置错误等问题

工具:

链接劫持

如果应用有一些媒体档案,第三方链接的网站,过期的域名,你都可以尝试接管

工具:

JS文件发现

主要是对JS文件进行搜索,包括了使用了硬编码,或者有敏感信息等等。 在挖掘JS文件的时候,你可以从下面几个点来进行:

  • 硬编码API
  • 敏感信息,包括AWS凭证等
  • S3 Buckets
  • 子域名
  • PII信息
  • API接口
  • 有趣的参数
  • 逻辑绕过限制,比如XSS和开放重定向

方法:

  • 自动化工具来搜硬编码
  • 自动化工具查找参数,关键字,接口和其他信息
  • 递归下载所有的JS文件,使用正则表达式查找信息
  • 在一段时间间隔内,比较这一段时间JS文件的变化

工具:

参数发现

通常你可以发现那些在应用中不直接可见但是仍然在服务器端处理的参数。这些参数很容易受攻击,包括SSRF,开放重定向,XSS,SQL注入和IDORs等等

工具:

回溯历史

检查回溯历史总是一个好主意。经常可以找到通过应用工作流程可能不再可用但仍可访问的 url。有时,敏感页面缓存时会显示有趣的信息,您还可以获得一些接口来测试各种不同的漏洞。

工具:

搜索

在特定领域的Github Dorking和Google Dorking是非常有用的,可以寻找到很多的接口,暴露的服务来增加攻击面。小范围的侦察中,可以使用检查认证令牌,uuid,用户标识符,备份文件,敏感信息缓存等。

工具:

敏感信息泄露

可以发现泄漏的凭证、数据库和各种组织的其他敏感信息,攻击者可能会滥用这些信息。然而,这可能或不可能被接受。

来源:

  • Intelx
  • Hacking Forums 黑客论坛
  • Darknet/Darkweb Analysis

云安全

现在很多公司正在向云基础设施转移,并使用云存储选项,如 AWS S3 bucket、 GCP bucket 等来存储他。然而,由于简单的配置错误,组织可能会向攻击者泄露/暴露一些信息。可以去枚举存储桶和其他基于云的服务,并查找其中的错误配置。

参考资料:

  1. https://cobalt.io/blog/scope-based-recon-smart-recon-tactics
  2. Misconfigured S3 Bucket Access Controls to Critical Vulnerability

漏洞挖掘365天挑战——Day019:Recon之内容发现

搜索引擎

可以使用Google来发现目录:

  • – File Extensions
  • – Parameters
  • – Login Page
  • – Sometimes Directory Structure
  • – Important Stuff

发现目录:

  • -site:target.com filetype:php
  • – site:target.com filetype:aspx
  • – site:target.com filetype:swf (Shockwave Flash)
  • – site:target.com filetype:wsdl

发现参数:

  • – site: target.com inurl:.php?id=
  • – site: target.com inurl:.php?user=
  • – site: target.com inurl:.php?book=

发现登录页:

  • – site: target.com inurl:login.php
  • – site: target.com intext: “login”
  • – site: target.com inurl:portal.php
  • – site: target.com inurl:register.php

发现目录结构:

  • -site: target.com intext: “index of /”

发现重要的页面:

  • -site: target.com filetype:txt
  • – site: target.com inurl:.php.txt
  • -site: target.com ext:txt

自动化工具:

  1. GoBuster
  2. Dirbuster
  3. FavFreak

API发现

这个话题,后面单独说。

以前写的几篇文章:

https://pxiaoer.blog/tag/api%e5%ae%89%e5%85%a8/

参考资料:

1.contextual-content-discovery https://blog.assetnote.io/2021/04/05/contextual-content-discovery/

漏洞挖掘365天挑战——Day018:Recon之Github扫描

在第7天(Day007: Github扫描),我写过Gihub扫描的一些工具问题。其实最好是自己有了目标之后,手动。这里写点手动,应该怎么搜索。

搜索关键字

  • FTP Credentials
  • Secret Keys [API_key, Aws_secret key, etc.]
  • Internal credentials [Employee credentials]
  • API Endpoints
  • Domain Patterns

例子:

  • – “target.com” “dev”
  • – “dev.target.com”
  • – “target.com” API_key
  • – “target.com” password
  • – “api.target.com”

也可以用Google来搜索

site: “github.com” + “Target” + password

社会工程