Is it ok if i monetise the data by being a consultant for it aswell? Just you like are. Have you made much money on it yet?
Personal and social information of 1.2B people discovered in data leak
411–420 of 440 posts
Re: Personal and social information of 1.2B people discovered in data leak
#412Earlier quoted context omitted.
Software should be secure by default. Don't blame the user. mySQL in comparison wont even let you install without setting a root password. And it only listen on localhost/unix-socket by default. Then you need to explicitly add another user if you want to allow it to login from a non local ip. I don't think it's even possible - to both set a blank root password and allow it to login from a public IP. So you really thi…
That MySQL stuff is all quite recent... up until 5.7 (?, one of the most recent releases, anyway) there's no root password by default and running `mysql_secure_installation` is a common (but not mandatory) step to, well, secure the installation and set a root password. I think MariaDB still works this way? Not sure. I'm not aware of "bind to localhost" being the default, either. The skip-networking setting to only al…
I installed mySQL a couple of months ago on a Ubuntu server, and got asked to set a root password. I've also installed mySQL many times on Windows. Secure install is the default. And it doesn't annoy me a bit. I like my software to be secure by default.
Re: Personal and social information of 1.2B people discovered in data leak
#413Earlier quoted context omitted.
That's still really insecure, because it means that as soon as someone manages to gain any access to that network or any of the services on that network has a security issue your database is wide open. That means that if someone manages to get access to the. I'd say public internet with proper (encrypted) password auth is more secure than that.
If attacker has access to app server it is already game over. App server typically already has access to all of the data. The pods are akin to localhost networking where there is only one externally available application with multiple networked components.
That's true, but there are usually multiple ways to compromise protected networks. You still need to protect the database against attacks that don't go through the app server.
Re: Personal and social information of 1.2B people discovered in data leak
#414It should be illegal for any company to store my private information like this. The 'anonymous' sharing of my information is easily de-anonymized. Sites asking for your phone number for "security purposes" are a joke. You just have to accept that absolutely everything you've done online is public information. If it isn't now, it is being stored and future tools / databases will make what is either difficult to access…
Such a cavalier attitude to the storage of EC citizens' personal data is illegal under Article 32 of the GDPR:
https://www.gdpr.org/regulation/article-32.html
Citizens of the US really need similar protections.
Re: Personal and social information of 1.2B people discovered in data leak
#415Earlier quoted context omitted.
This is ridiculous. Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of-use for new software. Redis was part of this a while ago http://antirez.com/news/96 . Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL inj…
If security is so important, why should we accept database developers who don't understand that?
Because... they dance the devops dance with their devop hats on! Security problems can be swiftly danced around until they actually surface, and can then be handled in the next round of "continuous delivery". It's also smart to postpone solving most issues until after they occur, so sales can continue bragging about "continuous improvement".
Re: Personal and social information of 1.2B people discovered in data leak
#416It's a tragedy that all of this data was available to anyone in a public database instead of.... checks notes... available to anyone who was willing to sign up for a free account that allowed them 1,000 queries. It seems like PDL's core business model is irresponsible regarding their stewardship of the data they've harvested.
If your in Europe or California, I suggest sending both companies an erasure request: https://yourdigitalrights.org/?company=peopledatalabs.com https://yourdigitalrights.org/?company=oxydata.io Disclaimer: I'm one of the creators of yourdigitalrights.org.
This is great. Thanks
Re: Personal and social information of 1.2B people discovered in data leak
#417Earlier quoted context omitted.
It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the u…
> It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products). I've met at least one cloud provider in the past (small Dutch thing) that provides _only_ public IP addresses. They do hav…
Heroku does the same in non-enterprise tiers. Their databases are accessible by the public internet with no option to limit it to your own dynos.
Re: Personal and social information of 1.2B people discovered in data leak
#418Maybe I am missing something here, but I do not really see the scandal here with the "leak" and I rather think the term is missleading in this context.
What happened?
As far as I understand, there are companies who search the web for public data of people like me, without my consent.
Then they sell that data. Also without my consent.
So that data was avaiable anyway, allmost for free. If this data would contain sensitive information, then I see this buisness practice as a scandal.
But the mere fact that all this data which was gathered without consent is now avaiable for free because of possible db missconfiguration .. is not a scandal to me.
And a leak is usually when a company loses sensitive data of its customers, who expected that data to remain confident, like emails. Not what happened here. Feels more like PR.
Re: Personal and social information of 1.2B people discovered in data leak
#419Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale? I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non-starter since that basically says everything is verboten).
A very large distributed network of machines.
Hey - not related to your comment (apologies) but wanted to get in touch . You left a note on a previous post of mine about wanting to simplify FTP. I'd love to work on this project and wanted to see if you'd be willing to connect so I can understand the problem better. Feel free to email me at kunal@mightydash.com, and thanks in advance!
Re: Personal and social information of 1.2B people discovered in data leak
#420Is there a way for an individual to check if he's in the dataset ? I am curious about what kind of data they'd have aggregated around me.