Earlier quoted context omitted.
EDIT: I misunderstood.
We have the same https://www.zeit.de/digital/datenschutz/2021-08/cdu-connect-...
I thought gp was talking abhobt their employer suing them for bugs they created.
Tell HN: Upgrade your Metabase installation
51–60 of 76 posts
Re: Tell HN: Upgrade your Metabase installation
#52Thanks for the heads up ! Without your message I'd probably have found out in a couple months :)
Re: Tell HN: Upgrade your Metabase installation
#53How many of you have received this notice via an official security advisory channel you're monitoring/acting on? If so, which advisory service do you use and how you configure it? Learning about HN is useful, but far from a reliable solution.
I am subsribed to their Github releases and when I saw a release for every old version I knew what's up :-)
Re: Tell HN: Upgrade your Metabase installation
#54Earlier quoted context omitted.
It is definitely not announced on Full Disclosure nor on oss-security mailing lists.
Doesn't look like there is a CVE either: https://www.cvedetails.com/vulnerability-list/vendor_id-1947...
> Will you release any information about the vulnerability?
> Yes, we’ll be releasing the patch publicly, as well as a CVE and an explanation in two weeks. We’re delaying release to give our install base a bit of extra time before this is widely exploited.
From their blog.
Re: Tell HN: Upgrade your Metabase installation
#55What would happen if a software's database was completely accessible via an open api end point?
Re: Tell HN: Upgrade your Metabase installation
#56This is why I try to put everything behind NGINX with basic auth. Unfortunately not everything works well that way but in this case I suspect that this is made unexploitable by anyone without the password.
I like NGINX, but I prefer how simple it is to set up Caddy with basic auth. Caddy is already simpler to configure (and has automatic SSL via Let's Encrypt), but it's so simple to get its basic directive working compared to NGINX that I do it by default now.
Re: Tell HN: Upgrade your Metabase installation
#57One of the better decisions we took at my firm was to not allow direct access to any production DB to analytics visualization tools like Metabase and Redash. Always write your analytics data to a separate DB in a periodically run job. Only store aggregated anonymized data in the analytics DB you expose to internal stakeholders via tools like Metabase.
Also your production database is optimized for different workloads than your analytics database.
Usually production is used for fetching and updating a small number of records at a time (think updating a shopping cart), and has strict latency requirements whereas analytics involves reading a large amount of data in columns (think count group by one or two columns), and can be done in batches where the results can get a more and more stale until the next batch runs.
Re: Tell HN: Upgrade your Metabase installation
#58Earlier quoted context omitted.
I thought when the OP of this comment thread said locally they meant like, it isn't exposed to the Internet
"exposed" as a word does a lot of heavy lifting here. When someone is asking me casually "hey, is this server exposed to the public internet"? I take it to mean "can someone connect to it in an inbound manner from the public internet?" If the answer is no, it doesn't necessarily mean that packets don't have other ways of making their way to the server, for example, a service running locally could have a webhook mecha…
[deleted]
Re: Tell HN: Upgrade your Metabase installation
#59How many of you have received this notice via an official security advisory channel you're monitoring/acting on? If so, which advisory service do you use and how you configure it? Learning about HN is useful, but far from a reliable solution.
I am subsribed to their Github releases and when I saw a release for every old version I knew what's up :-)
Yeah I do the same for projects I use. I also received an email but don't remember if I also signed up to their newsletters or something like that.
Re: Tell HN: Upgrade your Metabase installation
#60I think it's important to review the term "Zero Trust" because so many companies are getting it wrong.
Zero Trust does not mean: "No mor VPNs and private IP network ranges, everything is public. ::elitist hipster noises::"
Zero Trust simply means: "Just _because_ you're on a private network [or coming from a known ip], doesn't mean you're authenticated."
You should have every single one of your internal network services (like Metabase) behind a VPN like Wireguard or numerous other options. The sole purpose of this is to reduce your firewall log noise to a manageable level that can be reviewed by hand if necessary.
Obviously this isn't perfect security, but that's the _entire_ point: every security researcher says security should be an onion, not a glass sphere; many layers of independent security.