4 ms·
This needs auth with a randomly generated password by default. Standing up products like this is exactly how data breaches happen, it’s effectively sql injectio
by hsbauauvhabzb 4y ago
This needs auth with a randomly generated password by default. Standing up products like this is exactly how data breaches happen, it’s effectively sql injection as a feature.
- thevahidal 4y agoExactly, more generally I'm thinking of a way for Soul to be extendable via plugins, which one of the most important one is authentication / authorization and permissions level.
- hsbauauvhabzb 4y agoas a default
- thevahidal 4y agoYeah it's reasonable.
- Aeolun 4y agoIf you use this as your production database on the public internet that’s entirely on you. It’s the same issue people have with Redis.
- hsbauauvhabzb 4y agoThat’s like saying cars don’t need airbags because people should drive responsibly. Edit: case study: Optus, who leaked pii due to an unauthenticated api intended for internal use only but accidentally exposed to the internet.
- wharfjumper 4y agoI hadn't heard that about the Optus leak. Do you have a link with further details?
- hsbauauvhabzb 4y agoI’m sure google would, it was headline news aus wide for over a week.
- chx 4y agoIf we are talking of RESTful servers and mention Redis, then we should mention Webdis, which is a RESTful server for Redis -- and it has ACL. https://webd.is/ https://webd.is/ It is a very old but still active project.