Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The MongoDB hack and the importance of secure defaults

snyk.io

Post reply on HN
Print view View original

31–40 of 223 posts

Re: The MongoDB hack and the importance of secure defaults

#31

Post by steffan »

mikestew wrote: post #10

Microsoft took a rash of shit some time ago (15 years?) for shipping MS Proxy Server with every port open by default. From the POV of employee-at-the-time, it took them a disappointingly long time for them to not do that anymore. Since then, I've learned to not assume that products are secure-by-default. At the same time, I kind of thought we learned our lesson and cut that shit out low these many years later. Add a…

In fact, this setting has defaulted to localhost only for years. MongoDB 2.6, which made this the default, shipped on April 8, 2014

Re: The MongoDB hack and the importance of secure defaults

#32

Post by pvg »

mikestew wrote: post #10

Microsoft took a rash of shit some time ago (15 years?) for shipping MS Proxy Server with every port open by default. From the POV of employee-at-the-time, it took them a disappointingly long time for them to not do that anymore. Since then, I've learned to not assume that products are secure-by-default. At the same time, I kind of thought we learned our lesson and cut that shit out low these many years later. Add a…

That sounds like a truly awful rash.

Re: The MongoDB hack and the importance of secure defaults

#35

Post by omni »

nailer wrote: post #22
hitgeek wrote: post #16

Earlier quoted context omitted.

at v2.6 the product was only about 4 years old and underwent a lot of change during that time. (For comparison Postgres version 3 was released in 1991) I think the main guilty parties at mongodb were/are in marketing. technically sophisticated users understood the immaturity of the product and the tradeoffs that came with its architecture. however it was sometimes marketed as a general purpose data store, or as an al…

Even technically sophisticated users should be able to expect secure defaults.

Semantic counterargument: If you put a database into production without understanding its network and auth configuration then you are by definition not "technically sophisticated"

Re: The MongoDB hack and the importance of secure defaults

#37

Post by cpuguy83 »

richardwhiuk wrote: post #8
51Cards wrote: post #4

I have never used MongoDB so I admit I'm talking blind here, but can someone explain how/why a piece of highly popular software gets to version 2.6 allowing unsecured remote connections by default? Further to that is that type of thinking you want in the development process of something as critical as a database engine? It just seems amazing to me that it got so far before the community in general pushed back that th…

In production deployments, unsecured remote connections might be fine, because security would be handled at the network layer (e.g. by deploying MongoDB on a VLAN which only was accessible by your MongoDB clients which were on separate servers).

This is a really bad practice to follow. You can't rely on the network to be secure.

Re: The MongoDB hack and the importance of secure defaults

#39

Post by dx034 »

debacle wrote: post #29
mikestew wrote: post #10

Microsoft took a rash of shit some time ago (15 years?) for shipping MS Proxy Server with every port open by default. From the POV of employee-at-the-time, it took them a disappointingly long time for them to not do that anymore. Since then, I've learned to not assume that products are secure-by-default. At the same time, I kind of thought we learned our lesson and cut that shit out low these many years later. Add a…

Microsoft is a different beast. They ship things based on the principal of least surprise. There are incredible features in newer versions of SQL Server that aren't turned on by default when upgrading, even though no one would want to not have them on.

To be fair, SQL Server is probably the best product they've ever built. IMO, the only good reason to use Oracle was that it runs on Linux. With SQL Server on Linux, I'm sure they'll gain more market share over the next years.

As much as I like using open source alternatives like Postgres, SQL Server for me is by far the best database system, from standpoints of performance, features and tools.

Re: The MongoDB hack and the importance of secure defaults

#40

Post by overcast »

h4waii wrote: post #20
00deadbeef wrote: post #17

Earlier quoted context omitted.

I think the problem is developers running apt-get install mongodb and assuming all other considerations, like a firewall, are somehow magically taken care of, then patting themselves on the back for not needing a sysadmin.

This is absolutely the problem. There are high-horse developers who've made 4 webapps using PHP and don't know anything about the system they're deploying on -- but they're rockstars disrupting the world! They leave mysqld bound to 0.0.0.0 because they don't know any better. They SSH as root because they don't know any better. They have a default WordPress install with the config db sitting in webroot. But hey, their…

Everyone can't know everything, be realistic.
Post reply on HN