5 ms·

"Never" ... You are aware of the existence and mass use of shared web hosting systems right?

by mike-cardwell 14y ago

mmaunder 14y ago
Right. By this logic MySQL doesn't need authentication, never mind privileges.
- tptacek 14y ago
  Honestly? In most real-world applications, MySQL authentication and privileges have absolutely no effect on security.
  - mike-cardwell 14y ago
    Again, you're completely ignoring shared hosting systems. You have a very strange understanding of what "real-world applications" means when it comes to MySQL.
    - tptacek 14y ago
      One term for the applications you're thinking about is "certified pre-owned". Michel Zalewski just made a handy logo for those people to slap on the bottom of their front page: http://lcamtuf.blogspot.com/2012/06/this-page-is-now-certified.html http://lcamtuf.blogspot.com/2012/06/this-page-is-now-certifi...
      - mike-cardwell 14y ago
        "In most real-world applications, MySQL authentication and privileges have absolutely no effect on security." To me, that makes as much sense as: "In most real-world applications, file permissions have absolutely no effect on security." Or: "In most real-world applications, running services under isolated uids instead of running everything as root has absolutely no effect on security." It's a bold claim, but one made with no evidence to back it up.
tptacek 14y ago
Don't use shared web hosting.
- mike-cardwell 14y ago
  If ever a comment deserved down voting into oblivion, this would be it. Your advice is for everyone that is providing and using shared web hosting, to stop it?
  - tptacek 14y ago
    If you're using it for a real application, I'd move. Sorry if that makes you feel bad.
    - mike-cardwell 14y ago
      I'm not using shared hosting, no. Although I did work for a company that provided it a few years back. I'm just trying to figure out if you're actually being serious with your claim that everyone with a database backed website should be running it from isolated servers? If you actually understand the implications of this or if you're just making nonsensical off the cuff remarks? I wonder how many tens or hundreds of millions of servers that would add to the Internet.
      - tptacek 14y ago
        Of course I'm being serious. Don't run serious applications from the shared MySQL databases at shared hosting providers. You seem shocked that I'm saying this, but we work with a lot of very young startups and I have never met one running their app off a Dreamhost-style shared server. Tens or hundreds of millions of database servers? That's hyperbolic. Do you really think that we've come close to eliminating all the vulnerabilities inside a MySQL session, post-authentication? Because what you're arguing is effectively that application owners should trust that MySQL is resilient against attackers who can get an authenticated handle to their own database and run nearly arbitrary SQL statements against it. You think all the code in the MySQL query parser, the planner, and the various storage backends have been fully audited? This is a project that didn't even get authentication right.

"Never" ... You are aware of the existence and mass use of shared web hosting systems right?

mmaunder 14y ago

Right. By this logic MySQL doesn't need authentication, never mind privileges.

tptacek 14y ago
Honestly? In most real-world applications, MySQL authentication and privileges have absolutely no effect on security.
- mike-cardwell 14y ago
  Again, you're completely ignoring shared hosting systems. You have a very strange understanding of what "real-world applications" means when it comes to MySQL.
  - tptacek 14y ago
    One term for the applications you're thinking about is "certified pre-owned". Michel Zalewski just made a handy logo for those people to slap on the bottom of their front page: http://lcamtuf.blogspot.com/2012/06/this-page-is-now-certified.html http://lcamtuf.blogspot.com/2012/06/this-page-is-now-certifi...
    - mike-cardwell 14y ago
      "In most real-world applications, MySQL authentication and privileges have absolutely no effect on security." To me, that makes as much sense as: "In most real-world applications, file permissions have absolutely no effect on security." Or: "In most real-world applications, running services under isolated uids instead of running everything as root has absolutely no effect on security." It's a bold claim, but one made with no evidence to back it up.

tptacek 14y ago

Don't use shared web hosting.

mike-cardwell 14y ago
If ever a comment deserved down voting into oblivion, this would be it. Your advice is for everyone that is providing and using shared web hosting, to stop it?
- tptacek 14y ago
  If you're using it for a real application, I'd move. Sorry if that makes you feel bad.
  - mike-cardwell 14y ago
    I'm not using shared hosting, no. Although I did work for a company that provided it a few years back. I'm just trying to figure out if you're actually being serious with your claim that everyone with a database backed website should be running it from isolated servers? If you actually understand the implications of this or if you're just making nonsensical off the cuff remarks? I wonder how many tens or hundreds of millions of servers that would add to the Internet.
    - tptacek 14y ago
      Of course I'm being serious. Don't run serious applications from the shared MySQL databases at shared hosting providers. You seem shocked that I'm saying this, but we work with a lot of very young startups and I have never met one running their app off a Dreamhost-style shared server. Tens or hundreds of millions of database servers? That's hyperbolic. Do you really think that we've come close to eliminating all the vulnerabilities inside a MySQL session, post-authentication? Because what you're arguing is effectively that application owners should trust that MySQL is resilient against attackers who can get an authenticated handle to their own database and run nearly arbitrary SQL statements against it. You think all the code in the MySQL query parser, the planner, and the various storage backends have been fully audited? This is a project that didn't even get authentication right.