4 ms·
Postgres' defaults barely let you connect to the DB. You don't hear stories like this about Postgres.
by hashkb 10y ago
Postgres' defaults barely let you connect to the DB. You don't hear stories like this about Postgres.
- cpuguy83 10y agoWell, sure but then people just open the flood gates because it's such a pain in the ass to change postgres access policies. I guess secure by default means there aren't likely to be massive hacks like this, but it does not mean people are running securely.
- Kudos 10y agoIs it just that no one's running exploit scanners for Postgres then?
- dspillett 10y agoBut back when I was starting out you did get a hell of a lot of people choosing mysql over postgres partly based on the fact that the latter was easier to connect to out of the box, and/or filling the support channels with connection questions that are already answered in an installation guide in the documentation. Convenience "sells" even at the expense of security (and in this case, actually working properly at all!) and if you don't make it as easy as possible be prepared to support people who refuse to read the instructions.
- kosma 10y agopg_hba.conf is one of the reasons it took me so long to learn Postgres. Of course, now that I know it, I don't look back - but making the first step in learning a database "understand this weird model of AF_UNIX username == dbname trust" delayed the learning process by years.
- anarazel 10y agoFWIW, I'm a postgresql committer these days, and pg_hba.conf was probably the bit I was uncomfortable with for the longest (user level, not code level).