Stop censorship and give explainations

[jseguillon]

Ref #3544

[jseguillon]

This is not "too heated" to ask you why you behave so wrong.

[harshavardhana]

We initially explored a basic admin UI for the community branch but haven't actively maintained it. Building and supporting separate graphical consoles for the community and commercial branches is substantial. Honestly, it is hard to duplicate this work for the community branch. A whole team is involved in console development, including design, UX, front-end, back-end, and pen testing. This commit introduces an enhanced object browser but removes the unmaintained admin UI code.

Unlike the S3 RESTful APIs, admin actions in the console lack equivalent security protections. Without dedicated maintenance, this code risks introducing security vulnerabilities and creating misleading expectations for the community. For context, see past issues like the "Console Filename Masking Vulnerability" and "Metadata Bucket Name Bypass."

We're open to community contributions! If anyone is interested in taking on long-term development and security for the management console, we warmly welcome your pull requests.

We will thoroughly review such PRs which meet those requirements.

[dR3b]

@harshavardhana You should rather ask yourself: Why are there separate graphical consoles?!

[fragkp]

@harshavardhana But why wasn't this discussed EARLIER - all functions were simply deleted. You must realise that there will be an outcry.

[jseguillon]

@fragkp because this is probably post-mortem excuses but not the main reason, which probably was trying to force sale licensed version for money :/

[julienlau]

by the way it was forked 2 days ago and this commit was removed :
https://github.com/OpenMaxIO/openmaxio-object-browser

[jseguillon]

Yes that's some good news and maybe the best proof there was a way to find contributors if the MinIO team did try to search some.

[sunjam]

We're open to community contributions! If anyone is interested in taking on long-term development and security for the management console, we warmly welcome your pull requests.

Hard to imagine there being interest from any future community contributors, because the team must realize this sets a negative precedent, yes?

edit: It is worth trying to salvage any amount of good faith. People are asking because they care about your project, especially in regards to community contributions!

[yaneony]

Ah, displaying that popup nag on every UI load is also security measurement as well? Oh yeah...