3 ms·
Perhaps it's a controversial opinion, but I feel like it's just flat out unethical to relegate basic security to the paid/enterprise version of your product. O
by xvector 7y ago
Perhaps it's a controversial opinion, but I feel like it's just flat out unethical to relegate basic security to the paid/enterprise version of your product.
Of course it's unethical to use said product to store real user data too, but the road goes both ways.
- bouke 7y agoJust deploy it on your local network. No need to expose it to the internet. Sure, authentication is a nice bonus, but a simple firewall goes a long way.
- jturpin 7y agoI don't get why it ever needs to be on the internet even when it does have authentication. Surely the public/private subnet split is a common practice.
- kirstenbirgit 7y agoThe way I see it, password auth for db servers is the last-resort protection mechanism. If you get to the point where it’s what’s protecting your data, you’re already fundamentally screwed.
- CydeWeys 7y agoYou should definitely have it too, though.
- CydeWeys 7y agoUnless the private subnet is airgapped from the Internet, it's not a good enough separation. Hell, even if it is airgapped, it can still be compromised by viruses on USB sticks and such. You should never be leaving sensitive systems wide open, period, regardless of how secure you might think that network is. Thousands of data breaches have been caused because networks didn't end up being as secure or as separated as hoped for.
- CydeWeys 7y agoDefense in depth is important. Lots of data breaches have been caused because things that should have just been viewable from a local network, weren't, or the network was compromised. Unless you think every single employee is invulnerable to spear-phishing (which is impossible), you should never be leaving anything sensitive wide open on your local network.