4 ms·
I see everyone discussing how much Docker is at fault, how much Mongo DB is at fault, how much NewsBlur should have had better settings, and I do agree to some
by simiones 5y ago
I see everyone discussing how much Docker is at fault, how much Mongo DB is at fault, how much NewsBlur should have had better settings, and I do agree to some extent.
However, the much worse problem seems to be the fact that NewsBlur didn't test their network connectivity with something as basic as a port scan. This wasn't some complex attack based on some complex code injection jumping through legitimate ports or anything: their machine had the Mongo port open when they thought it should be closed. This is the kind of thing that absolutely shouldn't make it past basic testing.
- gerdesj 5y agoThank goodness that someone noticed the real problem: You can't see network traffic. You don't write a program and deploy it without testing, so don't do the same with your firewalls. You need to actually test your firewall policy and not blindly assume it does what you think it should.
- papito 5y agoAs the after-action report concludes, which is painfully obvious as you read this - should have been in a VPC.
- simiones 5y agoBut even before talking about the fix: the setup should have been tested, ideally before it was deployed (if possible).
- tbarbugli 5y agoyes, the author made a junior dev mistake and he is trying to blame [tool name here]. Making mistakes like this sucks but passing the blame makes it even worse.
- simiones 5y agoMaking mistakes is not the problem - everyone makes mistakes. But you need testing to catch your mistakes - this is a process failure.