Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MongoDB security notice

mongodb.com

Post reply on HN
Print view View original

131–140 of 198 posts

Re: MongoDB security notice

#131

Post by rglover »

goenning wrote: post #38

I never used/tried MongoDB, what are the reasons people choose MongoDB over other DBs?

- Highly-flexible. Because you're not developing against a schema, you can, for example, retool a feature and its data quickly without having to stress about migrations. A big advantage for a startup looking to move fast.

- Queries look more like application code so you're not wasting mental cycles and time trying to translate an idea into a SQL query. From experience, this leads to less-fragile queries.

- Little to no concern over injection attacks (you have to go out of your way to create potential for them).

- Easier to write non-trivial queries than with SQL (IMO).

- Type-casting data can be done in code as opposed to with SQL you have to use inline, platform-specific functions like field_name::timestamp.

- A single source of truth for how to query and develop with it (with SQL, you're almost always developing against a flavor of it).

- Scales reasonably well (and easily) for a majority of use cases.

- No room for dogmatic fervor/confusion around a specific variety of MongoDB as there's only one variety.

Re: MongoDB security notice

#132

Post by rubege »

superduperer wrote: post #80
WJW wrote: post #74

Earlier quoted context omitted.

They state these things in their quarterly filings with the SEC, in which to my knowledge it is not legal to knowingly misrepresent facts. If you have actual proof that MongoDBs auditors are lying to the SEC, you can probably get a pretty good whistleblower reward or at the very least make a ton of money selling this money to hedge funds specializing in shorting failing companies.

The SEC listings don’t contain real numbers about who is using the software. They can claim a bsbillion people use it as long as they can launder investor money into fake usage (like substack does) These numbers support my claim. If they had REALLY been growing they’d be a huge company right now, not having to pay people to use there products

They do contain their customer count - quick google search says it’s over 46,000 now which was surprising to me.

Re: MongoDB security notice

#133

Post by cowthulhu »

asdfsadfkljlkj wrote: post #109
meghan wrote: post #37

Earlier quoted context omitted.

MongoDB employee posting: The login issues are unrelated to the security incident. We notified all of our customers and users concurrently resulting in a spike in login attempts. Please try again in a few minutes if you are still having trouble logging in. Please continue to monitor our alerts page: https://www.mongodb.com/alerts

I mean that totally sounds related (hah!) although I guess we all know what they mean

That’s a funny point, I guess I never really though of whether “related” was more correlation or causation.

Re: MongoDB security notice

#134

Post by djrobstep »

rglover wrote: post #131
goenning wrote: post #38

I never used/tried MongoDB, what are the reasons people choose MongoDB over other DBs?

- Highly-flexible. Because you're not developing against a schema, you can, for example, retool a feature and its data quickly without having to stress about migrations. A big advantage for a startup looking to move fast. - Queries look more like application code so you're not wasting mental cycles and time trying to translate an idea into a SQL query. From experience, this leads to less-fragile queries. - Little to…

> Because you're not developing against a schema, you can, for example, retool a feature and its data quickly without having to stress about migrations. A big advantage for a startup looking to move fast.

Why wouldn’t you need to worry about migrations without developing against a schema? You’ll need to worry more about migrations because your data will be more messy.

Re: MongoDB security notice

#135

Post by cpursley »

pleoxy wrote: post #130
cpursley wrote: post #125

Earlier quoted context omitted.

And what's a good use case over Postgres jsonb?

When one doesn't want SQL for one. Nosql is a fun target to beat up on of late. But there are good, even infamous, reasons to avoid SQL. Particular if you want to accomplish flexible record queries from untrusted clients.

I’ll ask again, what’s a good use case over Postgres jsonb.

Re: MongoDB security notice

#136

Post by _sword »

nextworddev wrote: post #126
PeterZaitsev wrote: post #101

This highlights risks of extreme consolidation - even if Atlas customers were not affected it is natural for them to be concerned after announcement overwhelming web site or support channels. More independent MongoDB DBaaS providers is what would offer true redundancy in this case, though it is highly restricted due to SSPL license change. Hopefully FerretDB will be successful building feasible alternative

“Extreme consolidation” - wait till us-East-1 goes down

Happened in 2012 after a big thunderstorm and took most of the internet down

Re: MongoDB security notice

#138

Post by merek »

cpursley wrote: post #122
toasted-subs wrote: post #100

Almost decided to use MongoDB in a project for the first time. Kind of makes me unsure if it’s going to be the right choice.

Mongo is never the right choice. Postgres is nearly always the right choice, however.

Legitimate question, please don't downvote.

Are you basing this opinion on:

- popular HN opinion

- issues that Mongo experienced in its infancy

- mis-modelling highly relational data on a non-relational DB, and blaming the DB for ensuing problems

Or are you basing it on extensive experience with wide range of use cases?

Re: MongoDB security notice

#139

Post by godzillabrennus »

cpursley wrote: post #121

Why are people still choosing Mongo over Postgres these days? If there's something I'm missing, I'm genuinely curious as I'm not against json data and frequency use jsonb tables in Postgres.

People use MongoDB because it’s easy to get started. It does “db stuff” and “authentication”. I’ve given up trying to fight the trend. I just recognize immediately when it is used early on that the devs are still operating with training wheels on.

Re: MongoDB security notice

#140

Post by richbell »

jhardy54 wrote: post #98

> […] regularly rotate their MongoDB Atlas passwords Is there some context I’m missing, or is this a modern security team recommending password rotation?

Regularly rotating secrets for applications is good. Forcing users to regularly rotate their passwords is not so good.
Post reply on HN