4 ms·

From the original article, it seems to be ElasticSearch again. Why do so many companies expose ES to the open internet?

• tyingq 7y ago
  Terrible defaults, and stuff like this: https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-cluster/71310/17 https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-...
  • nullwarp 7y ago
    I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me.
    • vageli 7y ago
      > I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me. Security is an enterprise feature. Dealing with this now trying to enable SAML in a few SaaS apps, for example.
      • tyingq 7y ago
        It's not just locked behind the X-Pack...if you choose a trial, it works. Then, when the trial expires, poof...it's wide open. Surely there's a better way to handle that.
        • user5994461 7y ago
          As horrible at it sounds, it's just business. Large companies have a checklist that databases MUST be protected by authentication, so they always pay for the enterprise edition just to get authentication, and corollary the only way as a software editor to get money is to have authentication behind a pay wall.
          • tyingq 7y ago
            Sure, but fail "circuit open", not closed.
        • neurostimulant 7y ago
          Wow is this true? Instead of disabling access or shut down the db server they simply removed authentication and left the db wide open when trial expires?
          • tyingq 7y ago
            Was true in 2017. It has apparently been fixed since.
  • lucb1e 7y ago
    I was at a conference, last May I think, where an Elastic employee presented about exactly this topic (insecure defaults in database systems). If I remember correctly, they changed it from a commercial offering to secure by default now (before that talk already I'm pretty sure). Instead of bothering him/the rest of the audience I left it be (was probably from before his time), but yes, I was also wondering why security was part of the commercial offering... Anyway, past be past, this is no excuse in 2019 anymore (even if I will be hesitant with Elastic Co in the future).
• iforgotpassword 7y ago
  Like with the last leak a few days ago, I repeat my point: I also blame ES for this as it doesn't enforce authentication. ES people just keep blaming the people who set up those instances ("well duh it should not be facing the public internet") but after we see incident after incident, as a reasonable dev you should try to do your part to make the world a better place. Yes, you were not the one who set up the instance personally, but is it so hard to move a little bit in the direction of "hey a lot of personal information of uninvolved people gets leaked over and over again because of our defaults that stupid admins don't change. Maybe to protect the innocent, we can make ES to require some authentication method to be configured." Nope. No such thing, no empathy for the people affected by the leaks, all blame shifted, done.
• jersey 7y ago
  A year ago and this comment would have been asking why so many companies expose Mongo to the open internet.