Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

newsblur.com

Post reply on HN
Print view View original

331–336 of 336 posts

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#331

Post by scrollaway »

tluyben2 wrote: post #210
kstenerud wrote: post #199

Earlier quoted context omitted.

This isn't an entitlement issue; it's a public safety issue. If some philanthropist were to give out free bicycles to everyone, but it turns out that unless you tighten a bolt one of the main support bars will likely snap and could even impale you, the government would rightfully go after them regardless of any "without warranty" disclaimer or EULA. This is already well-trodden legal ground in the physical space; it'…

It will kill open source. And a lot of other small company software development.

No it won't. The example GP has given didn't kill any industry either.

Open source projects seldom get popular overnight. Responsibilities grow as you get more popular, that is all...

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#332

Post by tluyben2 »

scrollaway wrote: post #331
tluyben2 wrote: post #210

Earlier quoted context omitted.

It will kill open source. And a lot of other small company software development.

No it won't. The example GP has given didn't kill any industry either. Open source projects seldom get popular overnight. Responsibilities grow as you get more popular, that is all...

Software is very different than making bicycles. Anyone can make an open source project in their attic and promote it. You cannot do that with most (or any) other of those other examples as it takes actual factories etc.

That is the GP example. If I make 1 bike by hand and put that somewhere on the street, and someone takes it and breaks their legs, that is not my fault. Nor should it be. If I sell that 1 bike, that can be another story.

It will kill open source imho as if you, in your underwear in the attic are responsible for some code you write and put on GitHub, you won't write that code anymore because of the risk; but I don't want to find out who is right here.

Responsibilities should befall the person deploying the software. Aka if you write some software and throw in on GitHub, that should not do anything. But if I take that software and put it in my app or backend and takes people's money because of some bug, then I am the one who is responsible. And this is already the case anyway. No changes are needed.

I think we agree though as I think we are talking about the person who writes and deploys/sells the software: they should indeed be responsible and already are.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#333

Post by markdown »

kristofferR wrote: post #281
miles wrote: post #185

Earlier quoted context omitted.

> GDPR is a foreign law that has no relevance to American firms lol. I couldn't agree more with the spirit of your comment, but sadly the reality may be somewhat more nuanced: GDPR in the USA https://www.cookiebot.com/en/gdpr-usa/ " The GDPR has extra-territorial scope, which means that websites outside of the EU that process data of people inside the EU are obligated to comply with the GDPR. ... In fact, the very fi…

There's no sadly here, it's the opposite. In your world Facebook could still abuse European's privacy.

In my world, I would not be committing a crime if I, someone who has never stepped foot in Asia, criticised the Chinese Govt.

https://www.axios.com/china-hong-kong-law-global-activism-ff...

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#334

Post by lmm »

zylent wrote: post #320
lmm wrote: post #85

Earlier quoted context omitted.

I'd argue that that's a backwards approach and actually what lead to this hack - building this system around the database servers not being publicly exposed, thinking the database servers weren't publicly exposed, and then when you accidentally publicly expose them (and you will sooner or later, a network is too big a boundary to protect all of it) it's a disaster. It's better to build every server for public exposur…

Defense in depth / zero trust is definitely the way to go, however it's trivial to prevent a system from having internet access - for this hack to occur, the system had to be deployed with a public IP address directly assigned. NAT based internet access (IGW in AWS) or a private VPC with no IGW and no public on the instance is borderline standard in production cloud deployments these days. Re: "You will sooner or lat…

Every step is easy once you think about it; the hard part is spending any attention on it in the first place.

I would definitely say it's more effective to test your existing layers before adding more layers, and I think the "defence in depth" concept leads people astray there. Having multiple porous layers works on a battlefield where attacks are costly; it doesn't work on the internet where if one attack gets through an outer layer then all the other attacks can immediately get through the same way and start hitting the inner layer.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#335

Post by secabeen »

qbasic_forever wrote: post #318
patrakov wrote: post #260

Earlier quoted context omitted.

It is 100% unfair to blame Docker for this foot-gun, especially because they cannot really do anything to fix it, because that's how the firewall works in the Linux kernel. Look: Podman has exactly the same issue when not running rootless. The root cause is that IP packets going to the containers are not going through the INPUT chain of the "filter" table (they go through FORWARD), while various firewall projects lik…

My point is that this is a well-known issue with absolutely catastrophic results when you get it wrong. It would cost the docker app almost nothing to do a quick check on docker run to see if you're on a machine with iptables & ufw enabled, and then violently complain or fail in a very obvious ways like: *** WARNING YOUR FIREWALL ISN'T WORKING!! RUN AGAIN WITH --my_firewall_is_broken_and_I_accept_the_risks OPTION TO…

Docker could also enumerate the IP addresses on the host, and alert if there are any that aren't in RFC1918 space.

Re: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

#336

Post by zerd »

danielpops wrote: post #316
vngzs wrote: post #75

Earlier quoted context omitted.

I think there are some good lessons here: 1. Even if you have one way to protect your database (e.g., firewall rules), you should have another. In this case, use a database password or (better) client TLS certificate to authenticate traffic. We're all human and we mess up. You should be designing systems that are graceful in response to your inevitable mistakes. 2. If you can afford another server/a hosting provider…

Another takeaway, IMO, use infrastructure-as-code to define the components in your infrastructure, so something like this critical firewall configuration won't be missed

Docker will happily override your firewall rules even with infrastructure as code. We block the AWS/GCP metadata IP to avoid potential exploits using that to pivot, but Docker also manages to override that sometimes, so we have a cron job that re-applies it.
Post reply on HN