I thought this was an interesting comment[1] in the context of AWS:
>If the .ru site sent 404s for nonexistent users and 451s for real ones, you'd be able to gather potentially useful information. It's like if I go to bad-porn.com and type your email into "forgot my password", it should neither confirm nor deny the existence of your account, simply tell me the request was received. In any event if delivery of the requested resource is legally prohibited, why would I go to the trouble to determine whether the resource exists?
>A final analogy: 10 year old enters US gas station: "Have you Marlboro 100s, menthol?" gas station attendant (without checking whether or not he has this particular brand/style of cigarette): "get out of here, kid. [HTTP/1.1 451 Unavailable For Legal Reasons]."
Amazon will similarly return 404 for S3 assets which exist but which you don't have the right to see. Annoyingly, they will also do the opposite of the cigarette analogy in the AWS console: they will gladly let you walk though the whole process of configuring and launching an EC2 server and only reject you at the very end because you don't have permission. Hence my "AWS bar joke":
