5 ms·
Wasn't that a third-party going public about MongoDB, though? I don't think that counts.
by jlgaddis 9y ago
Wasn't that a third-party going public about MongoDB, though? I don't think that counts.
- nl 9y agoAt the time MongoDB shipped with all databases completely public, with no authentication credentials. That meant anyone could connect over HTTP and get your data. From the article: The problem for MongoDB users seems to be that on some systems the default configuration has the database listening on a publicly accessible port as soon as it’s installed. Users are supposed to read the manual and set up access control and authentication after installing the software but it seems that plenty of them don’t. I think that counts.
- jlgaddis 9y agoYeah, I recall. Certainly that was a major screw up but, IMO, the users share part of the blame -- if they had a firewall in place this wouldn't have been an issue.
- nl 9y agoIMO, the users share part of the blame -- if they had a firewall in place this wouldn't have been an issue. Yes of course, users are always responsible. That doesn't mean shipping a product with zero default security was a sensible thing either. I'd note that other database vendors don't do this.
- smt88 9y agoUsers are (almost) always at fault when a car crashes. Should cars not ship with seatbelts or airbags? User error is a guarantee, and great software minimizes the paths to an error and also eliminates classes of error that are easy to eliminate.
- SilasX 9y agoMongo shares the blame for making it the default and making authentication such a pain to deal with: - Command line login never works, you have to get into Mongo shell, then authenticate. - Attaching multiple db permissions to one user has all kinds of gotchas to: I have to switch to each database and re-auth instead of just authing to the user and then switching DBs without further auth. None of it works intuitively.
- deleted 9y ago[deleted]