4 ms·

Network oriented software created after 2000 has zero excuse for allowing unauthenticated writes from the general internet by default.

• stouset 10y ago
  Tell that to redis. No, seriously. Please. I've been banging that drum for years.
  • andreyf 10y ago
    Also, MySQL [1]. Are you sure that you're right and all these major db projects are wrong? 1. note the default value of "bind to *": http://dev.mysql.com/doc/refman/5.7/en/server-options.html#option_mysqld_bind-address http://dev.mysql.com/doc/refman/5.7/en/server-options.html#o...
    • stouset 10y ago
      At least MySQL can speak TLS.
    • jldugger 10y ago
      Well, mysql was started before 2000, so it gets a pass. But I'm also pretty sure mysql doesn't allow unauthenticated writes, so it doesn't need one?
  • StavrosK 10y ago
    Redis doesn't listen on localhost by default? I've deployed countless redis instances and that's news to me. Did Debian/Ubuntu change the default default?
• andreyf 10y ago
  What about the "this is the most common setting used by our clients"? Is that not a good "excuse" for being the default?
  • jldugger 10y ago
    Here's a semi-sane default for people who want the simple case to just work: - require authentication for remote network connections - allow r/w from any local connection, tcp or unix Random devs installing mongo on their workstation will Just Work, but won't expose customer data to the internet.