2 ms·

> By default Parseable uses a public S3 compatible store (MinIO) to store the data. Please change this to your S3 bucket before storing any important data. Wai

> By default Parseable uses a public S3 compatible store (MinIO) to store the data. Please change this to your S3 bucket before storing any important data. Wait, am I reading that right? Does this mean by default the docker container is going to store my data in a random place on the internet? If so that's a crazy bad default.

belthesar 4y ago
Whoa. At first read, I assumed it was spinning MinIO alongside the Parseable daemon, but no, it's definitely sending data to a MinIO instance _they host_. https://github.com/parseablehq/parseable/blob/a7abb5dfe1ca573fbe4726228cc84d16e86ba28b/server/src/s3.rs#L37 https://github.com/parseablehq/parseable/blob/a7abb5dfe1ca57... No bueno.
- trueleo 4y ago
  > Please do not store any sensitive data on this server as the data is openly accessible. We'll delete the data on this server periodically. It is there for demo purpose ig It also gives you this warning when you run the build Warning: Parseable server is using default credentials. Setup your credentials with P_USERNAME and P_PASSWORD before storing production logs. Parseable server is using default object storage backend with public access. Setup your object storage backend with P_S3_URL before storing production logs.
  - thayne 4y ago
    Having a public place to send demo logs is fine. Sending logs there by default, rather than having to opt in to demo mode, is bad. The default should be to fail to start unless credentials for the data store are provided. Or alternatively store to the local filesystem by default.
  - Volundr 4y ago
    The problem is this means I'm one misconfiguration away from sending all my data to a stranger's server on the internet. If I misconfigure an Ansible playbook or kubernetes deploy I'm not going to see that warning. Frankly even if a sysadmin is configuring it by hand we shouldn't be counting on them noticing the warning for our security. I believe they have good intentions and are just trying to make it easy to try out, but this is just too big a footgun hanging out. Makes it untouchable for me.

belthesar 4y ago

Whoa. At first read, I assumed it was spinning MinIO alongside the Parseable daemon, but no, it's definitely sending data to a MinIO instance _they host_. https://github.com/parseablehq/parseable/blob/a7abb5dfe1ca573fbe4726228cc84d16e86ba28b/server/src/s3.rs#L37 https://github.com/parseablehq/parseable/blob/a7abb5dfe1ca57... No bueno.

trueleo 4y ago
> Please do not store any sensitive data on this server as the data is openly accessible. We'll delete the data on this server periodically. It is there for demo purpose ig It also gives you this warning when you run the build Warning: Parseable server is using default credentials. Setup your credentials with P_USERNAME and P_PASSWORD before storing production logs. Parseable server is using default object storage backend with public access. Setup your object storage backend with P_S3_URL before storing production logs.
- thayne 4y ago
  Having a public place to send demo logs is fine. Sending logs there by default, rather than having to opt in to demo mode, is bad. The default should be to fail to start unless credentials for the data store are provided. Or alternatively store to the local filesystem by default.
- Volundr 4y ago
  The problem is this means I'm one misconfiguration away from sending all my data to a stranger's server on the internet. If I misconfigure an Ansible playbook or kubernetes deploy I'm not going to see that warning. Frankly even if a sysadmin is configuring it by hand we shouldn't be counting on them noticing the warning for our security. I believe they have good intentions and are just trying to make it easy to try out, but this is just too big a footgun hanging out. Makes it untouchable for me.