3 ms·
"From time to time I get security reports about Redis. It’s good to get reports, but it’s odd that what I get is usually about things like Lua sandbox escaping,
by bigiain 1y ago
"From time to time I get security reports about Redis. It’s good to get reports, but it’s odd that what I get is usually about things like Lua sandbox escaping, insecure temporary file creation, and similar issues, in a software which is designed (as we explain in our security page here http://redis.io/topics/security http://redis.io/topics/security) to be totally insecure if exposed to the outside world." -- antirez, 4 Nov 2015, https://antirez.com/news/96 https://antirez.com/news/96
- antirez 1y agoYep, however people don't configure things properly so many years ago I introduced a middle ground between not listening to * (which makes things harder for users in actual deployment systems) and leaving the server exposed, that is: protected mode. If Redis has the default configuration to bind all the addresses and no auth is configured, it refuses commands and informs you how to configure it properly. This avoided many security problems, and avoid also the feeling I always had as a user of other systems defaulting to binding to only local interfaces, where you need to understand what to do in order to make it reachable from other computers.