3 ms·
Yeah I get that, but a single "mongodb or whatever cluster database behind bigchaindb that you are using was called" drop tables * ; query would actually delete
by antocv 10y ago
Yeah I get that, but a single "mongodb or whatever cluster database behind bigchaindb that you are using was called" drop tables * ; query would actually delete your so called blockchain. Thats a huge security whole, which last time I checked bigchaindb - would be solved "administratively" ie operational security level instead of protocol.
Not to sound like an ass though, I do keep an eye on bigchaindb for what it is to become as the people behind it do seem to have great talent.
Has that security issue been resolved? How is the ipdb secured?
- trentmc 10y agoWe acknowledge this attack vector and others; and list them in github. It's in our roadmap to address them. The current schedule is the following: we're currently wrapping up the a base MongoDB integration (next couple weeks); on the heels of that we'll improve the MongoDB replication (a couple months); and on the heels of that we'll address the "drop" issue (and other unwanted commands) via a wire protocol firewall. More security stuff to follow that. BTW thanks for the kind words about our team. I think they're amazing too:)