211–220 of 544 posts
Would especially be useful if you were tinkering with firewall/security settings and accidentally opened something up.
I prefer this over having data stolen. Also as a rule of thumb never ever expose anything but port 80 and 443 if hosting a webapp. If you must expose services other than http/s then be sure to not leak its version, have it secured properly and _always_ up to date. The user running such services should also be a non privileged user, the daemon chrooted, and the OS should have appropriate process and filesystem permiss…
Okay, and I prefer being waterboarded over being drawn & quartered. But it doesn't mean I support the practice of waterboarding, since there's another option, namely just not waterboarding in the first place.
This contrarianism is so strange to me. Data not being deleted by a bad actor is preferable to having it deleted, and I would think that would be the main takeaway here, rather than this weird descent into counterfactuals. Where does the impulse come from to bypass the normal answer, treat it like a trick question and go into contrarian mode by measuring it against counterfactuals? I think when you do that you lose sight of the most important thing here, which is the fact that data is being wantonly deleted and that it is bad that this is happening.
It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag... ). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "n…
Who do you think should regulate the “public”? ISPs, police, government?
Earlier quoted context omitted.
The top-voted answer links to this HN page. I'm stuck in an infinite loop.
You should configure a timeout.
For real code, you wouldn't generate a web page with 5 million entries in it, so you can be pretty sure that the data is bad even if it's not cyclical (but it probably is)
People are talking about more responsible disclosure. Is it feasible to even track down the owners of 4,000 different unsecured databases, much less go through the whole process with them to ensure the database is properly secured?
That's more or less the best you can do without unreasonable effort, and there's no guarantee the database's owners will ever see the extra database unless you also destroy stuff on the way to make them pay attention...
Earlier quoted context omitted.
Isn’t exposing ports in your docker-compose services:redis:ports, how you’d do that? (Docker hobbyist here)
My guess would be that they went with "ports" instead of "expose" which makes it public. But even with careful composition of your docker-compose you might want to be careful, Docker can interact with iptables in surprising ways and long iptables rulesets are almost comically difficult to validate sometimes. The result is that if you're using both Docker (and even more if you use Compose, Kubernetes, some other orche…
"The EXPOSE instruction does not actually publish the port. It functions as a type of documentation between the person who builds the image and the person who runs the container, about which ports are intended to be published."
Earlier quoted context omitted.
Would you feel the same way if someone burned your house down if you left the door unlocked? Would you support the idea of people walking through a neighborhood and checking every door in a similar way? Does your opinion change if it happened in a business district? I think it is fine to argue that doors should be locked but that doesn't mean that a crime hasn't been committed when someone takes advantage of a situat…
I think the major difference is that losing my house along with all my belongings is much worse than losing just some of my belongings. Also data being exposed publicly can be used nefariously by multiple parties, so is likely worse in most scenarios compared to just outright deletion of the data
Whatever analysis you want to put on the situation I don't think it is reasonable to start with the idea that some of the data might not be that valuable.
Earlier quoted context omitted.
Good tree^H^H^H^Hgraph traversal algorithms have a history stack specifically to detect and deal with loops.
>tree^H^H^H^Hgraph If we pretend we're using readline here, ^W (yank previous word) and ^U (yank to the start of the line) should save you some key presses. Some recommended bedtime reading: https://catonmat.net/ftp/readline-emacs-editing-mode-cheat-s... https://en.wikipedia.org/wiki/GNU_Readline#Emacs_keyboard_sh...
My favorite is ^U, which 90% of the time lets you start over on a password prompt when you are sure you just fat fingered but not sure how badly.
Earlier quoted context omitted.
Good tree^H^H^H^Hgraph traversal algorithms have a history stack specifically to detect and deal with loops.
1) If it‘s a tree, it ain‘t got no loops 2) The stack isn‘t to deal with loops, the „visited“ flag at each edge is there for that. The stack (for DFS, BFS would be a queue) is there to keep track of which nodes have been visited such that you can construct a path from the starting node to the one you‘re looking for. Obviously there are variants to this, depending on what you‘re actually trying to achieve with it. My…