4 ms·
In this day and age with breaches happening daily and publicly why hasn't mongo taken security seriously and enabled authentication by default?
by agotterer 10y ago
In this day and age with breaches happening daily and publicly why hasn't mongo taken security seriously and enabled authentication by default?
- stefano 10y agoMaybe that would hurt their "get started easily" proposition, which was very imporant to get them where they are now.
- bryanrasmussen 10y agoyeah but now they're there, with a big built in base of people who don't want to stop selling their skills. So they can make a new get started securely proposition.
- dexterdog 10y agoBut it's always "grow or die"
- raverbashing 10y agoThis might be useful https://docs.mongodb.com/v3.2/administration/security-checklist/ https://docs.mongodb.com/v3.2/administration/security-checkl... (But let's say binding on 0.0.0.0 or not having a firewall in the system are not only their fault) In the same way people can trust local addresses in Pgsql
- deleted 10y ago[deleted]
- user5994461 10y agoOr why is it so hard to enable authentication at all? Or why enable flags that allow to loose data without warnings in many common circumstances? Don't expect anything from mongo. Don't trust mongo. Don't use mongo.
- achillean 10y agoThey have improved a few things. The new versions of MongoDB don't bind to the public interface and they have the capacity for authentication (unlike the early releases). I believe this is why the most popular versions of unauthenticated MongoDB are the 2.x versions: https://blog.shodan.io/its-still-the-data-stupid/ https://blog.shodan.io/its-still-the-data-stupid/