Earlier quoted context omitted.
Like, how does the local mom and pop correctly evaluate a person's IT chops? Usually by price and unfortunately both mom and pop like a bargain - I've seen this play out more times than I would like. Also how do you evaluate, say, a landscaper's chops? Or any other kind of contractor's for that matter? By doing research beforehand, checking what kind of reputation that person has etc. Low-effort or lack of research g…
In construction and landscaping work those companies are usually licensed, bonded and insured. If they fuck up the work there's obvious financial recourse. Also, the measure of them fucking up is generally a lot clearer for physical labor and for mom and pop businesses, getting construction work inspected by a 3rd party is usually more straightforward and cheaper. In software, financial recourse generally means you h…
New ‘Meow’ attack has deleted almost 4k unsecured databases
171–180 of 544 posts
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#172Earlier quoted context omitted.
So is deleting a database. Putting a password and emailing the admin would solve the password problem. But I agree doing anything is probably illegal. I would leave it... not worth hassle of wearing the superman cape.
How about simply emailing the admin to tell them their database is unsecured? Oh, but that would be benign; I'm sure vandalism is so much more fun.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#173Earlier quoted context omitted.
Isn’t exposing ports in your docker-compose services:redis:ports, how you’d do that? (Docker hobbyist here)
My guess would be that they went with "ports" instead of "expose" which makes it public. But even with careful composition of your docker-compose you might want to be careful, Docker can interact with iptables in surprising ways and long iptables rulesets are almost comically difficult to validate sometimes. The result is that if you're using both Docker (and even more if you use Compose, Kubernetes, some other orche…
Use nmap to evaluate your policy from the outside, don't try to validate it in your head by inspection.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#174Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#175Why must some people insist on being assholes?
The ones leaving giant databases unsecured? At least they are being taught an important lesson.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#176Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#177So why is the attack being called Meow?
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#178Earlier quoted context omitted.
This is why we are refactoring our database to be able to migrate to Amazon documentdb from MongoDB. Encryption at rest.... Pay up!
Curious, why do you use Mongo? Does it give you something that a JSONB column in Postgres wouldn’t?
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#179Earlier quoted context omitted.
And what about the responsibility to not destroy someone's property? Do you have the same opinion about shoplifters walking away with merchandise? Would your argument be that there should be armed guards and searches in every retail store? Isn't it reasonable that a thief be criticized and penalized for their actions even if the theft was "easy" to commit and is it OK to blame the victim for not being prepared?
Agree with nkrisc -- this is like, if I contracted with a storage company, and then my stuff was vandalized because the company's "secure storage location" was an unlocked box out on the sidewalk. Obviously the vandal is directly to blame, but it's also absolutely negligence from the company. I'm sympathetic for the people who were only storing their own data, but not for companies that failed to safeguard their cust…
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#180Earlier quoted context omitted.
What you propose is illegal in most 1st/2nd world countries. In mine, the company could thank you and then put you straight to jail for 30 years. Unfortunately very few small businesses run sade reporting programs and often react with attack.
I certainly think the most legal approach is to do nothing except notify, or maybe nothing at all. But if you must modify the database, locking it reversibly is more defensible morally.