3 ms·
This just says to me that MongoDB's defaults should be changed. It's happening too much. A somewhat random password would at least provide some protection and
by BLanen 8y ago
This just says to me that MongoDB's defaults should be changed.
It's happening too much.
A somewhat random password would at least provide some protection and minimal inconvenience for devs.
- thinkingemote 8y agoThe defaults on Ubuntu at least have been changed (not sure since when, though) "since release 2.6.0 we have made localhost binding the default configuration in our most popular deployment package formats, RPM and deb" from https://www.mongodb.com/blog/post/update-how-to-avoid-a-malicious-attack-that-ransoms-your-data https://www.mongodb.com/blog/post/update-how-to-avoid-a-mali...
- achillean 8y agoBy default, MongoDB doesn't listen on the public interface so it won't be exposed to the Internet - it only listens to localhost. Old versions of MongoDB had bad defaults but that hasn't been the case in years: https://blog.shodan.io/its-still-the-data-stupid/ https://blog.shodan.io/its-still-the-data-stupid/