The Majority of PostgreSQL Servers on the Internet Are Insecure
innerjoin.bit.io
The Majority of PostgreSQL Servers on the Internet Are Insecure
1–10 of 30 posts
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#2That's a strange take on the subject of db servers and ssl usage.
Most db servers shouldn't be accessible on internet, which skews the announced result a lot.
And, obviously, clients and servers generally won't require ssl by default, because it would make no sense in most situations. (but at least the 'prefer' default setting is mentionned)
Requiring a certificate to run the server isn't something that is likely to become the default setting for a while...
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#3That's a strange take on the subject of db servers and ssl usage. Most db servers shouldn't be accessible on internet, which skews the announced result a lot. And, obviously, clients and servers generally won't require ssl by default, because it would make no sense in most situations. (but at least the 'prefer' default setting is mentionned) Requiring a certificate to run the server isn't something that is likely to…
I think the announced results are specifically referring to servers available on the internet.
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#4That's a strange take on the subject of db servers and ssl usage. Most db servers shouldn't be accessible on internet, which skews the announced result a lot. And, obviously, clients and servers generally won't require ssl by default, because it would make no sense in most situations. (but at least the 'prefer' default setting is mentionned) Requiring a certificate to run the server isn't something that is likely to…
(co-author) - `prefer` is... not great. That'll silently fall back to an unencrypted connection without warning the user.
If you are the one using a programming library directly, you may know that `prefer` does this. If you are using a client that doesn't expose this to you, you may not know that you are using an unencrypted connection after you had set ssl on.
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#5That's a strange take on the subject of db servers and ssl usage. Most db servers shouldn't be accessible on internet, which skews the announced result a lot. And, obviously, clients and servers generally won't require ssl by default, because it would make no sense in most situations. (but at least the 'prefer' default setting is mentionned) Requiring a certificate to run the server isn't something that is likely to…
I think the announced results are specifically referring to servers available on the internet.
That's GP's point, that's already a 'smell' (in the strict 'hm, that seems suspiciously like it might not be right' sense).
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#6* unsecure
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#7Maybe they’re insecure because they’re unsecured?
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#8That's a strange take on the subject of db servers and ssl usage. Most db servers shouldn't be accessible on internet, which skews the announced result a lot. And, obviously, clients and servers generally won't require ssl by default, because it would make no sense in most situations. (but at least the 'prefer' default setting is mentionned) Requiring a certificate to run the server isn't something that is likely to…
I think the announced results are specifically referring to servers available on the internet.
[deleted]
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#9Unfortunately the clickbait headline does not convey the enormous streetlight-effect skew in the sample.
This article is essentially content marketing for a DBaaS company, for which the author appears to serve as CTO, to promote a alternative default configuration that favours their business model.
Re: The Majority of PostgreSQL Servers on the Internet Are Insecure
#10* unsecure
Correct!
According to Google, "insecure" means:
1. not firmly fixed; liable to give way or break. 2. (of a person) not confident or assured; uncertain and anxious.
and "unsecure":
1. (especially of a computer system) not protected against attack or other criminal activity. 2. (of a loan) unsecured.