11–20 of 75 posts
This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
There are lots of lessons in the internet's limited history that show poorly conceived defaults are the most common and dangerous mistake. Microsoft let Frontpage Extension credentials default to the domain name and a blank password through multiple major versions, without any prompt to change anything (you had to seek out the settings, and it wasn't even obvious where they were). Throughout the late 90s and early 00…
This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
This same article was posted previously, so I will post the same response Don't repaste your own comments just because there's been a dupe.
Even if you forget that the cloud is the internet and that the entire internet can reach you over the internet, it doesn't take a genius to set up a password for a cloud service. I have no idea how many of these databases are honey pots, but finding open and vulnerable servers is depressingly simple.
I suppose it's kind of liberating to know that you can be dumb enough to fling patient data into an unprotected cloud server and still get a job in IT. The bar is really set that low.
This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
Interesting that ES is still such a widely used component, this is a huge red flag about a software product. And of course there are lots of other regular complaints about it (eg uses a lot of memory and wants a 3-node cluster so costs 4 figures/mo to run on AWS).
It cost that much because AWS is incredibly expensive.
Earlier quoted context omitted.
There are lots of lessons in the internet's limited history that show poorly conceived defaults are the most common and dangerous mistake. Microsoft let Frontpage Extension credentials default to the domain name and a blank password through multiple major versions, without any prompt to change anything (you had to seek out the settings, and it wasn't even obvious where they were). Throughout the late 90s and early 00…
I remember hearing about FrontPage Extensions back in the day. I never had an opportunity to make use of them since I used Dreamweaver at the time, but what exactly were they? I tried googling, but couldn’t find a plain language explanation, only opaque marketing speak.
Another great example why I love to use managed services / serverless services and not take care of security groups and NACLs
Interesting. The conclusion you draw from this differs wildly from my conclusion. Whenever I read stories like these, it seems clear to me that someone moved to the cloud in order to not have to care about security. The 'cloud does everything for you!'. Just like you imply in your answer that PaaS, the next level of abstraction, will solve all your security problems. This move, however, will inevitably lead to a situ…
Zero trust everything.
This same article was posted previously, so I will post the same response I posted on the other thread: Elasticsearch until recently did not nudge you to set up a username or password by default. I noticed the last time I installed it on a fresh instance that on completion of the install it gives you a warning about this and tells you what to do to set a password. That is a small improvement. Most people would not ha…
Interesting that ES is still such a widely used component, this is a huge red flag about a software product. And of course there are lots of other regular complaints about it (eg uses a lot of memory and wants a 3-node cluster so costs 4 figures/mo to run on AWS).
Earlier quoted context omitted.
Interesting that ES is still such a widely used component, this is a huge red flag about a software product. And of course there are lots of other regular complaints about it (eg uses a lot of memory and wants a 3-node cluster so costs 4 figures/mo to run on AWS).
Because ES cluster should not be on public network. If anything this is red flag for AWS. ES v8 there many improvments to security. It cost that much because AWS is incredibly expensive.
If a product upon unboxing promptly flops on its back with "come here internet" access controls, even if by good fortune it's saved by your network ACLs, it's time to put it back in the box and return it.
Binding to 0.0.0.0 is unfortunately the default for Docker. I wish it would have been different.