4 ms·

Thanks! That is the sort of stuff I was asking about. It looks like it's an after thought but at least on their mind now, which is very fair with respect to Bl

• femto113 3y ago
  Adding a veneer of security isn't necessarily superior to leaving it out altogether. Systems of this sort are best secured at the network level, i.e. only trusted hosts should be able to connect to it. Redis is a good example of where this has been tried: it does support password based log in, but the password is stored and transmitted in plaintext, and a redis server will happily accept thousands of auth attempts per second making brute forcing a viable attack. Rather than improve the auth system Redis has instead doubled down on encouraging appropriate network level security by defaulting to only being accessible to the local host, so admins have to go through an explicit step (with warnings) before they can just expose it to the internet.
• deleted 3y ago
  [deleted]
• ljm 3y ago
  > I think it is, relativley speaking, rude to release insecure networked software And if you believe that, you're wrong