Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The MongoDB hack and the importance of secure defaults

snyk.io

Post reply on HN
Print view View original

141–150 of 223 posts

Re: The MongoDB hack and the importance of secure defaults

#141

Post by z3t4 »

mike-cardwell wrote: post #88

When our sysadmin set up our Mongo cluster, he firewalled out all IPs except our production systems, turned on authentication, set things up to ensure we used SSL, and configured backups. He didn't do this because he's an amazing sysadmin. He did it because he's competent, knows how to put a service on the Internet, and RTFM. I mean. If you can connect to something and use it without having to authenticate yourself,…

Next time you cross a bridge, make sure it will handle your weight ... And think about everything that can possible go wrong, what materials are used, and how old it is, etc.

Re: The MongoDB hack and the importance of secure defaults

#142

Post by theGimp »

ajross wrote: post #123
mike-cardwell wrote: post #88

When our sysadmin set up our Mongo cluster, he firewalled out all IPs except our production systems, turned on authentication, set things up to ensure we used SSL, and configured backups. He didn't do this because he's an amazing sysadmin. He did it because he's competent, knows how to put a service on the Internet, and RTFM. I mean. If you can connect to something and use it without having to authenticate yourself,…

That's the same logic that says people who get fired from their jobs should be homeless and starve, or that those who get sick without insurance should be denied care. We don't do that in our society. There's a moral distinction between culpability and impact. There are profoundly stupid things that people do, yet still need protection from. Those DB admins were incompetent by lots of measures, but their data still h…

I'm no Mongo fan, but that's a false equivalence. You don't need to use Mongo in order to survive.

Re: The MongoDB hack and the importance of secure defaults

#143

Post by debacle »

orf wrote: post #80
debacle wrote: post #29

Earlier quoted context omitted.

Microsoft is a different beast. They ship things based on the principal of least surprise. There are incredible features in newer versions of SQL Server that aren't turned on by default when upgrading, even though no one would want to not have them on.

Can you give some examples?

Read isolation is probably the biggest stand-out in terms of "Wow this is way faster why would anyone* not use this?"

* Almost anyone, there are definitely potential pitfalls.

Re: The MongoDB hack and the importance of secure defaults

#144

Post by aioprisan »

morgo wrote: post #98
aioprisan wrote: post #78

Earlier quoted context omitted.

You can set up the latest MySQL with a blank root password and open to the world as well. The lack of good security options is a 1.x-ism, now there are plenty of security mechanisms now https://docs.mongodb.com/v3.2/administration/security-checkl...

It is much harder to do this with MySQL. The default is now a randomly generated password. You have to overwrite it with --initialize-insecure if you want to setup with a blank password.

I don't buy that. Just did an apt-get install mysql-server and it let me install with a blank password (Ubuntu 16.04 MySQL Server 5.7)

Re: The MongoDB hack and the importance of secure defaults

#145

Post by ajross »

theGimp wrote: post #142
ajross wrote: post #123

Earlier quoted context omitted.

That's the same logic that says people who get fired from their jobs should be homeless and starve, or that those who get sick without insurance should be denied care. We don't do that in our society. There's a moral distinction between culpability and impact. There are profoundly stupid things that people do, yet still need protection from. Those DB admins were incompetent by lots of measures, but their data still h…

I'm no Mongo fan, but that's a false equivalence. You don't need to use Mongo in order to survive.

And having your data stolen is preferable to starving. The point is that, morally: X is bad X being all Y's fault doesn't imply that Y should be unprotected from the consequences of X.

We help each other out in this society. So in this case if you're a database developer with a good handle on deployment security, you don't put a insecure-by-default product in the hands of people who aren't. I genuinely can't understand why people are arguing to the contrary.

Re: The MongoDB hack and the importance of secure defaults

#146

Post by danielweber »

nevi-me wrote: post #105
mike-cardwell wrote: post #88

When our sysadmin set up our Mongo cluster, he firewalled out all IPs except our production systems, turned on authentication, set things up to ensure we used SSL, and configured backups. He didn't do this because he's an amazing sysadmin. He did it because he's competent, knows how to put a service on the Internet, and RTFM. I mean. If you can connect to something and use it without having to authenticate yourself,…

I first started using Mongo in 2013/4, when I deployed my app, first thing I did was to change the default port and add authentication, as the manual recommended. I'm an accountant who's a hobbyist developer. I knew very little about security then, but I read the manual. The insecure defaults were an issue sure, but anyone installing a piece of software in production without at least reading up on config options need…

Meanwhile, the FTC sued D-Link over insecure defaults in their cameras.

We need good and consistent rules about this, and "well I was giving it away for free" isn't as clear a boundary as people will think it is.

Re: The MongoDB hack and the importance of secure defaults

#147

Post by aioprisan »

tormeh wrote: post #36

Who, when wanting to write a secure piece of software, thinks: "I know! I'll use JavaScript!"? Security was always going to be an afterthought at best. There are legitimate reasons for writing things in JavaScript, and none of them apply to a database.

You got it wrong, MongoDB is written in C++. I guess it's easier to jump on the JS hate bandwagon than look it up for yourself.

Re: The MongoDB hack and the importance of secure defaults

#148

Post by aioprisan »

grzm wrote: post #61
tormeh wrote: post #60

Earlier quoted context omitted.

MongoDB is written in Javascript.

In part. According to the Github repo, it's 75% C++, 18% JS. https://github.com/mongodb/mongo

The JS is from docs and examples, not from core MongoDB code.

Re: The MongoDB hack and the importance of secure defaults

#149

Post by Rapzid »

pmlnr wrote: post #129
mike-cardwell wrote: post #88

When our sysadmin set up our Mongo cluster, he firewalled out all IPs except our production systems, turned on authentication, set things up to ensure we used SSL, and configured backups. He didn't do this because he's an amazing sysadmin. He did it because he's competent, knows how to put a service on the Internet, and RTFM. I mean. If you can connect to something and use it without having to authenticate yourself,…

sysadmin - that title is becoming rare. Would you expect the same competancy from a devops, or a site reliability engineer? ( Not trolling, real question; as a sysadmin myself I do see that priorities differ in many cases when a dev or a manager wants to see a service running and you have until yesterday. )

I'm not sure the way titles are being thrown around in this thread is entirely helpful. opsy vs devsy, sysadmin vs devops? What exactly is a "devops"?

I would expect anyone responsible for something to have competency in it or find someone who is to help. Titles are irrelevant.

Re: The MongoDB hack and the importance of secure defaults

#150

Post by [deleted] »

nevi-me wrote: post #105
mike-cardwell wrote: post #88

When our sysadmin set up our Mongo cluster, he firewalled out all IPs except our production systems, turned on authentication, set things up to ensure we used SSL, and configured backups. He didn't do this because he's an amazing sysadmin. He did it because he's competent, knows how to put a service on the Internet, and RTFM. I mean. If you can connect to something and use it without having to authenticate yourself,…

I first started using Mongo in 2013/4, when I deployed my app, first thing I did was to change the default port and add authentication, as the manual recommended. I'm an accountant who's a hobbyist developer. I knew very little about security then, but I read the manual. The insecure defaults were an issue sure, but anyone installing a piece of software in production without at least reading up on config options need…

[deleted]
Post reply on HN