Gah, I know just how easily this can happen. About a year ago, an app I run had grown to the point where a Linode setup wasn't adequate/cost-effective enough a

Gah, I know just how easily this can happen. About a year ago, an app I run had grown to the point where a Linode setup wasn't adequate/cost-effective enough and I migrated it to a multi-server dedicated environment with a Redis Docker container handling queue processing and caching between the machines. I presumed the UFW rules I'd set would protect it from the outside world. It all seemed to be working fine when I went to bed, then when I woke up in the morning, someone had found the open Redis port and had set up a replication node and was streaming all the data to themselves. Super-luckily it wasn't handling anything sensitive (just weather data in a small farming region in Australia) but boy oh boy did it hit me just how bad it could have been if it was handling sensitive data for a lot of users. So I feel for these guys; I'm no security expert but I've been running web apps on Linux servers for nearly 20 years and have never had a breach before, so I feel like it's a pretty easy mistake to make.