3 ms·
The first paragraph says he made a mistake when uninstalling Redis, he didn't have it running on purpouse. Everyone is fallible, things tend to go wrong. Insec
by zurn 11y ago
The first paragraph says he made a mistake when uninstalling Redis, he didn't have it running on purpouse.
Everyone is fallible, things tend to go wrong. Insecure defaults in software hurt even expert devs (which this guy is if you look at his blog).
If your software is "designed to be totally insecure if exposed to the outside world" you should not ship it with defaults exposing it to the outside world. IOW you should not design software to be totally insecure by default.
- dijit 11y agobut it runs and binds to 127.0.0.1 by default, what better default is there for this?
- zurn 11y agoAccording to http://www.antirez.com/news/96 http://www.antirez.com/news/96 it binds to 0.0.0.0 by default, though in latest versions there is an example config file provided for binding to 127.0.0.1
- tedunangst 11y agobinding to 127.0.0.1 by default would be much better than the actual default of all addresses.
- pizza234 11y agoOf course everyone is fallible, and this is the reason why careful admins put safeguards and layers of security. In a well-prepared system, the administrator would: #1 block input traffic on all the ports, except the required ones. as routine, after uninstalling any service, open ports are reviewed; even if a service is forgotten running, it won't be able to communicate. #2 not run redis or any service as root user. Not doing so is, to say the least, reckless, and with this assumption/context, it doesn't make much sense to theorize about software design.
- Pxtl 11y agoSecurity and usability exist in direct opposition to each other. Software that chooses security first is too unusable to gain real adoption by users
- hippich 11y agoI believe installing UFW and blocking everything except what you actually use (22, 80) is the way to go.