4 ms·

MongoDB is the premier example [1] of why software should be "secure by default" [2]. 1. https://hn.algolia.com/?query=mongodb%20unsecured&sort=byPopularity&pr

MongoDB is the premier example [1] of why software should be "secure by default" [2]. 1. https://hn.algolia.com/?query=mongodb%20unsecured&sort=byPopularity&prefix&page=0&dateRange=all&type=story https://hn.algolia.com/?query=mongodb%20unsecured&sort=byPop... 2. https://en.wikipedia.org/wiki/Secure_by_default https://en.wikipedia.org/wiki/Secure_by_default

ratling 8y ago
MongoDB has for years been the premiere example of 'what not to do.'
umvi 8y ago
From your [2]: > Security by default, in software, means that the default configuration settings are the most secure settings possible, which are not necessarily the most user friendly settings. The hard part is making it both secure by default but also developer (user) friendly. If you make it so that it is super secure by default, but onerous just to get your product setup because of all the security overhead developers are going to get frustrated and either disable all the security or use a competitor's (less secure) product that is easier to setup and you are back at square one. There are so many options out there that if you try to launch a product (DB, webserver, etc.) and it's really hard for the developer to get started ("step 1, before you can try out this webserver, first register an account with Let's Encrypt") nobody is going to use it. It's not an easy problem to solve because people are inherently lazy and want results fast. Security done right is the opposite of that in its current state.
- kijin 8y ago
  When it comes to databases, either 1) listening on localhost by default or 2) requiring a non-obvious password would seem to strike a decent balance between security and usability. But MongoDB is web scale! Nobody is going to run it on localhost only! So the default (until 2.6) was to listen on all interfaces by default. AFAIK Elasticsearch still listens on all interfaces by default. Does this choice make life any easier for the developer who is just beginning to learn how to use it? I dunno, most of my development work takes place on localhost. I probably won't even notice if a newly installed database only listens on localhost.
  - deleted 8y ago
    [deleted]

ratling 8y ago

MongoDB has for years been the premiere example of 'what not to do.'

umvi 8y ago

From your [2]: > Security by default, in software, means that the default configuration settings are the most secure settings possible, which are not necessarily the most user friendly settings. The hard part is making it both secure by default but also developer (user) friendly. If you make it so that it is super secure by default, but onerous just to get your product setup because of all the security overhead developers are going to get frustrated and either disable all the security or use a competitor's (less secure) product that is easier to setup and you are back at square one. There are so many options out there that if you try to launch a product (DB, webserver, etc.) and it's really hard for the developer to get started ("step 1, before you can try out this webserver, first register an account with Let's Encrypt") nobody is going to use it. It's not an easy problem to solve because people are inherently lazy and want results fast. Security done right is the opposite of that in its current state.

kijin 8y ago
When it comes to databases, either 1) listening on localhost by default or 2) requiring a non-obvious password would seem to strike a decent balance between security and usability. But MongoDB is web scale! Nobody is going to run it on localhost only! So the default (until 2.6) was to listen on all interfaces by default. AFAIK Elasticsearch still listens on all interfaces by default. Does this choice make life any easier for the developer who is just beginning to learn how to use it? I dunno, most of my development work takes place on localhost. I probably won't even notice if a newly installed database only listens on localhost.
- deleted 8y ago
  [deleted]