Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MongoDB security notice

mongodb.com

Post reply on HN
Print view View original

31–40 of 198 posts

Re: MongoDB security notice

#31

Post by [deleted] »

alexzeitler wrote: post #27
iaresee wrote: post #20

Earlier quoted context omitted.

On our side, Okta is saying the auth is good. I'm trying my personal account as well and it's telling me MFA isn't set up (it is) and it's making me go through the MFA setup flow again. All attempts to setup another 2FA code in 1Password or to get even an SMS code sent to my phone are failing. Edit: Personal account with a TOTP 2FA is working again now as well. This is feeling worse than they're letting on to.

Sign in now worked once and sent me into the MFA setup loop but it failed.

[deleted]

Re: MongoDB security notice

#33

Post by mananaysiempre »

dnndev wrote: post #7
wg0 wrote: post #4

Irrelevant but curious if MongoDB is still being picked up for Greenfield projects given it's licensing.

What’s wrong with licensing?

MongoDB’s SSPL is neither an open source license[1] nor, most likely, a free software one[2]. Its definition of offering the licensed software as a service is so broad most Linux distributions[3–6] flat out refuse to ship MongoDB (not even in a nonfree repository or the equivalent) so as to (among other things) avoid placing the operators of their package mirrors in legal jeopardy.

[1] https://blog.opensource.org/the-sspl-is-not-an-open-source-l...

[2] https://opensource.stackexchange.com/q/13888

[3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=915537

[4] https://fedoraproject.org/wiki/Changes/MongoDB_Removal

[5] https://bugzilla.opensuse.org/show_bug.cgi?id=1122267

[6] https://lists.archlinux.org/archives/list/arch-dev-public@li...

Re: MongoDB security notice

#35

Post by varelaz »

ranting-moth wrote: post #15
wg0 wrote: post #4

Irrelevant but curious if MongoDB is still being picked up for Greenfield projects given it's licensing.

Their license "is to require that enhancements to MongoDB be released to the community." I think it only hurts people who want to freeride the project and extend it for selfish personal gains. That's OK by me.

That's reply to Amazon abuse of MongoDB (DocumentDB)

Re: MongoDB security notice

#37

Post by meghan »

iaresee wrote: post #17

We are completely locked out of our Atlas account and the support portal right now. We Okta-auth with Mongo and all attempts to auth right now are failing with "The request contained invalid data." displayed on their login screen. Of course, the support portal requires you to auth to use it...to get help with auth failing. Anyone else seeing issues getting in to their dashboard? Edit: Auth started working for us and…

MongoDB employee posting:

The login issues are unrelated to the security incident. We notified all of our customers and users concurrently resulting in a spike in login attempts. Please try again in a few minutes if you are still having trouble logging in.

Please continue to monitor our alerts page: https://www.mongodb.com/alerts

Post reply on HN