101–110 of 116 posts
Any chance that this vulnerability is linked with the recent hashed password lists disclosure ?
Earlier quoted context omitted.
You're just swapping one exposed service for another in that case. Ie, OpenSSH instead of MySQL. On other other hand, I'd trust OpenSSH more than MySQL.
Well, you're reducing the exposed services from two (mysql + ssh), to one (ssh). Which is always a good idea. Also agreed. I'd trust OpenSSH to do security better than MySQL.
Earlier quoted context omitted.
From a security perspective it's good advice. I've never seen a shared web hosting provider whose boxes couldn't be owned by an account that could drop code and execute. Local priv escalation holes seem to be a dime a dozen and you don't know if they've even attempted to lock down their users' data. Now, do you really care if some community bulletin board's database gets owned? Probably not. But I wouldn't run a shop…
If you don't really care about security --- and I agree there are times when you shouldn't --- then by all means use the cheapest possible hosting option available to you. But if you care even a little about security, avoid shared hosting. I really don't understand Mike Cardwell's objection; I don't think what I'm saying is controversial at all. I actually thought I was making a relatively banal point.
You: Attackers should never, ever be able to connect directly to your MySQL database directly
Me: "Never" ... You are aware of the existence and mass use of shared web hosting systems right?
Earlier quoted context omitted.
If you don't really care about security --- and I agree there are times when you shouldn't --- then by all means use the cheapest possible hosting option available to you. But if you care even a little about security, avoid shared hosting. I really don't understand Mike Cardwell's objection; I don't think what I'm saying is controversial at all. I actually thought I was making a relatively banal point.
I'll just leave the following here. Maybe you can figure out from it what my point was: You: Attackers should never, ever be able to connect directly to your MySQL database directly Me: "Never" ... You are aware of the existence and mass use of shared web hosting systems right?
Earlier quoted context omitted.
I'll just leave the following here. Maybe you can figure out from it what my point was: You: Attackers should never, ever be able to connect directly to your MySQL database directly Me: "Never" ... You are aware of the existence and mass use of shared web hosting systems right?
I think you're having trouble with the intended target of the word "you" in my comment. I'm not writing to people hosting Minecraft forums on Dreamhost.
EDIT: You could have just replied to my original comment agreeing with me that shared hosting systems work that way, and that it's ok for certain types of site. It would have made more sense than your comment "Don't use shared web hosting."
Earlier quoted context omitted.
Right. By this logic MySQL doesn't need authentication, never mind privileges.
Honestly? In most real-world applications, MySQL authentication and privileges have absolutely no effect on security.
Earlier quoted context omitted.
I think you're having trouble with the intended target of the word "you" in my comment. I'm not writing to people hosting Minecraft forums on Dreamhost.
Perhaps you should have been more careful with your wording. It demonstrated a lack of understanding of real world configurations and requirements and implied that if you're doing it that way, you're doing it wrong. I'd guess that most websites live in shared hosting systems. EDIT: You could have just replied to my original comment agreeing with me that shared hosting systems work that way, and that it's ok for certa…
If you don't fit either of those molds, I don't think any less of you, but I'm not going to tailor my advice to you either.
It really sounds like you're just looking for something to be indignant about. I don't know you or anything about you, so I had no expectation that you were that kind of person. Consider addressing your objections to the thread, instead of aiming them at me, if you'd like to avoid that appearance. For truly, I do not care whether you like shared hosting or your friends are struggling indie shared hosting operators. That's not relevant to me even a little.
A less personal way to frame your objection, rather than "Are you commenting just so you can be downvoted to oblivion", would be to write a comment that starts with the words "There is another side to this that readers should consider..." and go from there.
Earlier quoted context omitted.
Honestly? In most real-world applications, MySQL authentication and privileges have absolutely no effect on security.
Again, you're completely ignoring shared hosting systems. You have a very strange understanding of what "real-world applications" means when it comes to MySQL.
http://lcamtuf.blogspot.com/2012/06/this-page-is-now-certifi...
Earlier quoted context omitted.
except that they try to optimize randomness in security libraries every now and then.
Any more details? Not had any problems on that side of things yet.
It looks like this is being tracked in Ubuntu here: https://bugs.launchpad.net/bugs/1011371 Unfortunately Oracle's stewardship of MySQL appears to be a closed model. There is no public access to their bug tracker, and distributions struggle to keep up with security updates because the details of their fixes in the source are not published. The future of MySQL appears to be in one of the MySQL forks. See https://lists…