Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MongoDB security notice

mongodb.com

Post reply on HN
Print view View original

151–160 of 198 posts

Re: MongoDB security notice

#151

Post by rezonant »

webappguy wrote: post #41
insanitybit wrote: post #8

Nice and to the point, makes it clear that this is early, explains the current scope, tells us to expect a follow up as the information makes its way to them. I like this tbh and I hope people won't punish them for not including more info when this is clearly in the early days of investigation.

It was only DETECTED on the 13th, and they suspect had been going on 'for some time'. And basically not sure if user data was touched but they suspect or haven't provided it yet buly saying'NOT'. I want answers.

Your options are: (A) Vendor waits until all the facts are in place and the investigation is finished or (B) Vendor tells customers as early as practical so they can take their own mitigation steps.

You do not have the option of (C) Vendor should tell me about a breach they don't yet know about.

Re: MongoDB security notice

#152

Post by rezonant »

infamouscow wrote: post #114
insanitybit wrote: post #8

Nice and to the point, makes it clear that this is early, explains the current scope, tells us to expect a follow up as the information makes its way to them. I like this tbh and I hope people won't punish them for not including more info when this is clearly in the early days of investigation.

Agreed. For all the shit MongoDB gets, this is something that people should take a step back and recognize as very high in integrity, transparency, and trust. Other businesses should follow their lead here. I'm more inclined to do business with MongoDB because they've demonstrated these principles first-hand.

I don't use Atlas but I do use self hosted MongoDB, and have been pretty happy with that product. I have the impression that a lot of the dirt slung at Mongo was about unreliability and data loss of the core product early on, which (knock on wood) hasn't been a problem for me on the small to medium scale use cases I've deployed it on. Seems reliability has taken a lot of positive strides over the years.

Re: MongoDB security notice

#153

Post by PeterZaitsev »

nextworddev wrote: post #126
PeterZaitsev wrote: post #101

This highlights risks of extreme consolidation - even if Atlas customers were not affected it is natural for them to be concerned after announcement overwhelming web site or support channels. More independent MongoDB DBaaS providers is what would offer true redundancy in this case, though it is highly restricted due to SSPL license change. Hopefully FerretDB will be successful building feasible alternative

“Extreme consolidation” - wait till us-East-1 goes down

Yep. Though to be fair AWS provides options for multi region availability.

What did not happen (yet) is complete AWS meltdown

Re: MongoDB security notice

#154

Post by rezonant »

nextworddev wrote: post #126
PeterZaitsev wrote: post #101

This highlights risks of extreme consolidation - even if Atlas customers were not affected it is natural for them to be concerned after announcement overwhelming web site or support channels. More independent MongoDB DBaaS providers is what would offer true redundancy in this case, though it is highly restricted due to SSPL license change. Hopefully FerretDB will be successful building feasible alternative

“Extreme consolidation” - wait till us-East-1 goes down

Amazon sells it cheap compared to other regions-- it's economically incentivized for us-east-1 to take out half of the Internet.

Re: MongoDB security notice

#155

Post by PeterZaitsev »

forwardemail wrote: post #21
dnndev wrote: post #7

Earlier quoted context omitted.

What’s wrong with licensing?

Encryption at rest is not supported in the community/free version of MongoDB. We built an email service (IMAP support added a month ago) and wrote a WebSocket to SQLite layer to solve our encryption at rest needs for storage. See our deep dive at https://forwardemail.net/blog/docs/best-quantum-safe-encrypt... for insight.

Note Percona Server for MongoDB is drop-in replacement for MongoDB and supports Data at Rest Encryption, on SSPL version

https://docs.percona.com/percona-server-for-mongodb/5.0/data...

Re: MongoDB security notice

#156

Post by winrid »

godzillabrennus wrote: post #139
cpursley wrote: post #121

Why are people still choosing Mongo over Postgres these days? If there's something I'm missing, I'm genuinely curious as I'm not against json data and frequency use jsonb tables in Postgres.

People use MongoDB because it’s easy to get started. It does “db stuff” and “authentication”. I’ve given up trying to fight the trend. I just recognize immediately when it is used early on that the devs are still operating with training wheels on.

Sometimes this is the case but not always... It's nice to just work with objects in some languages... for some projects. That's engineering - picking trade offs :)

Re: MongoDB security notice

#157

Post by pleoxy »

cpursley wrote: post #135
pleoxy wrote: post #130

Earlier quoted context omitted.

When one doesn't want SQL for one. Nosql is a fun target to beat up on of late. But there are good, even infamous, reasons to avoid SQL. Particular if you want to accomplish flexible record queries from untrusted clients.

I’ll ask again, what’s a good use case over Postgres jsonb.

All you do is poop all over the story about postgres. I'm convinced that no use cases will convince you of anything. I'm not really looking to involve myself in a database holy war.

Re: MongoDB security notice

#158

Post by endisneigh »

kagevf wrote: post #113
Jonovono wrote: post #52

Earlier quoted context omitted.

It's a really great alternative to firebase for mobile apps. Works pretty nicely with Realm so you get offline first db with powerful syncing. All the benefits of realm on the edge device with the power of the mongo platform. I dismissed mongo atlas for years because "mongo", until I finally gave it a chance. Overall been pretty pleased.

> It's a really great alternative to firebase for mobile apps. Isn't firebase built on top of mongoDb?

No

Re: MongoDB security notice

#159

Post by dissident_coder »

toasted-subs wrote: post #100

Almost decided to use MongoDB in a project for the first time. Kind of makes me unsure if it’s going to be the right choice.

If you’re trying to solve a problem and think “I’ll use mongodb”, well now you’ve got two problems.

Just pick postgres. If you have unstructured data as input, either put in the effort to create some kind of schema for it if you can or just use jsonb if you can’t.

Re: MongoDB security notice

#160

Post by abrookewood »

webappguy wrote: post #41
insanitybit wrote: post #8

Nice and to the point, makes it clear that this is early, explains the current scope, tells us to expect a follow up as the information makes its way to them. I like this tbh and I hope people won't punish them for not including more info when this is clearly in the early days of investigation.

It was only DETECTED on the 13th, and they suspect had been going on 'for some time'. And basically not sure if user data was touched but they suspect or haven't provided it yet buly saying'NOT'. I want answers.

Give them some time.
Post reply on HN