41–50 of 116 posts
Ubuntu always ship fucked up, broken, shitty MySQL versions.
Look at the one that is current HEAD on 10.04 LTS. It's got so much broken stuff in it, we had to move everything to a spare windows machine where we could stick a later version on without screwing up the machine (DBs for: team city, jira, crucible).
Why 1/256?
This is a vulnerability in the authentication scheme used in the MySQL wire protocol, meaning attackers need to be able to connect to your MySQL database directly to exploit it. Attackers should never, ever be able to connect directly to your MySQL database directly . If you can connect to your MySQL instance directly from your Macbook in your living room, fix it right now .
What is the best way to enable replication without access to the database? ssh tunnel?
Doesn't surprise me. Ubuntu always ship fucked up, broken, shitty MySQL versions. Look at the one that is current HEAD on 10.04 LTS. It's got so much broken stuff in it, we had to move everything to a spare windows machine where we could stick a later version on without screwing up the machine (DBs for: team city, jira, crucible).
Earlier quoted context omitted.
I would imagine you have to try a different password each time.
Why would you imagine that? The bug is that what password you provide doesn't matter.
It sounds like they were casting the result of a memcmp to a char. A char only has a range of -128 to 127. The resulting overflow means that an arbitrary password hash has a 1/255 chance of landing on 0, but you still have to try a bunch to hit one.
Doesn't surprise me. Ubuntu always ship fucked up, broken, shitty MySQL versions. Look at the one that is current HEAD on 10.04 LTS. It's got so much broken stuff in it, we had to move everything to a spare windows machine where we could stick a later version on without screwing up the machine (DBs for: team city, jira, crucible).
Earlier quoted context omitted.
―Attackers should never, ever be able to connect directly to your MySQL database directly. mySQLgame[1] demonstrates that domain logic can be successfully implemented within a publicly accessible database[2]. It would be better to reword your statement to: Minimise the attack surface by preventing unnecessary access There are times where public access to a database server make perfect sense. It is the reason why data…
I would generally avoid building applications that assume clients are going to speak directly to the database. We see a couple of them every year (it's a common pattern in enterprise applications) and they tend to be horrorshows. In any case, the typical web app deployed by HN readers has no business having an exposed MySQL port.
This works well. There are some things we are still working on improving, but it's getting there. Moreover it means multiple clients on multiple codebases are possible and we don't have to worry as much about the implications of what happens when someone writes a secondary client to hit the database.
At the same time, we use PostgreSQL, which I have a bit more confidence in than MySQL. Of course I would still suggest limiting access only to those IP address ranges where that is necessary.
Doesn't surprise me. Ubuntu always ship fucked up, broken, shitty MySQL versions. Look at the one that is current HEAD on 10.04 LTS. It's got so much broken stuff in it, we had to move everything to a spare windows machine where we could stick a later version on without screwing up the machine (DBs for: team city, jira, crucible).
Why would you screw up the machine if you just installed the latest deb?
Doesn't surprise me. Ubuntu always ship fucked up, broken, shitty MySQL versions. Look at the one that is current HEAD on 10.04 LTS. It's got so much broken stuff in it, we had to move everything to a spare windows machine where we could stick a later version on without screwing up the machine (DBs for: team city, jira, crucible).
Why migrate to a completely different environment? I'd recommend just installing some version of percona server (mySQL flavour) instead. You get both better software and upstream version instead of a repackaged one.
I'm in the process of binning it all and moving to Debian which is actually trustworthy...