4 ms·

I joined Oracle in 2012, and I myself complained that the user experience was horrible: get an Oracle DB installed was a nightmare, starting with so many questi

I joined Oracle in 2012, and I myself complained that the user experience was horrible: get an Oracle DB installed was a nightmare, starting with so many questions. I heard complaints from other users about it requiring, during installation, that an admin password must be set. I myself had preferred to use MySQL because it was so simple and easy to get started and using it. Until I learned how many MySQL databases were configured without user/password and many instances were reachable over the internet. Then, eventually products started to move towards "don't even ask the user to set a password, otherwise they will set a stupid password" and just generate the password during installation. This made the user think more before saving that password or changing the password to something less stupid. But better than all that, liability was no longer with the software maker.

dwedge 2mo ago
Maybe it's distro specific but I'm fairly sure mysql by default installed with skip networking around 2012, and with bind-address set to localhost since then. Also the root user is only configured from local by default but I'm not sure if that was true 14 years ago. If the defaults are more secure than your examples, it's not fair to blame the database or the defaults. And personally I hate it when software forces security requirements on me. Maybe I don't need an admin password. It's one reason I gave up on selfhosted gitlab - there was no option to reduce password complexity for my users, and those users were only connecting from the local network. The other reason being that it spammed 100GB of logs in a month and was using 11GB of RAM before I'd even gotten around to setting up the first repo.
- dylan604 2mo ago
  Most software matures to the point that sane defaults get set. In the early days, one could be forgiven for making MVP as the security and attack vectors were still growing. Now that attacks have matured, and new software that is released without mitigation of these mature risks is just dumb and lazy and deserve no forgiveness for being released that way.
- z3t4 2mo ago
  You should use a user directory (AD) and then use single sign on (SSO) or or the like. It feels kinda stupid at first, but when you have many users and many apps the AD will make life easier and with SSO users can sign in with one click of a button.
- danudey 2mo ago
  MySQL installed with skip-networking was very common, but as soon as you need to access it over the network (e.g. when you move from one box with MySQL and PHP to one for each) then you have to enable networking and everything falls apart. Also, the number of times in my career that I've googled a problem and seen some forum post saying "Oh, just run chmod -R 777 /var/www/wordpress/uploads/ and it'll fix that" "Great it worked thanks!" tells me that it's the blind leading the blind out there and I'm sure there's tons of forum posts telling people how to disable authentication on their MySQL and disable iptables on their server so that their PHP app can connect to the DB without a password.
  - chanux 2mo ago
    It's surprisingly hard to convince supposedly trained tech professionals that `chmod -R 777 /path/to/whadever` is not a good habit.
    - dwedge 2mo ago
      Or curl https://hopefullyatleasthttps.com https://hopefullyatleasthttps.com | sudo bash
- brendoelfrendo 2mo ago
  I guess I'm confused; why would you, as an admin, want to allow your users to use less secure passwords? I get that your argument is that all traffic is local and so complex passwords are unnecessary (debatable, I would hold that a strong password policy would still be desirable for defense-in-depth, depending on the network and risk profile), but that doesn't make them undesirable.
  - dwedge 2mo ago
    We were in the middle of setting everything up company wise (for just two of us), didn't have the password manager yet and I was dictating the password to them. It might be a stupid use case, I agree, but not unreasonable. I didn't say strong passwords are undesirable I said forcing the admin of self hosted software to have to use strong passwords with not even a --yes-im-stupid flag is undesirable
- tredre3 2mo ago
  > selfhosted gitlab - there was no option to reduce password complexity for my users Gitlab's default requirements aren't that intense, but you can make them more stringent if you want. https://docs.gitlab.com/user/profile/user_passwords/#password-requirements https://docs.gitlab.com/user/profile/user_passwords/#passwor... I guess your goal was to allow users to have 4 character passwords, i.e. "love." which afaik you can't do.
  - dwedge 2mo ago
    They must have changed that or I was completely off base because I was just trying to remove special characters and drop it from 12 (I think) and I saw them close a feature request saying they didn't think they should support it. It's possible I misunderstood and the feature request was as you say
redsocksfan45 2mo ago
[dead]
com2kid 2mo ago
I got bit by this with redis a couple years ago. The default install on my VPS's distro had it open to the world by default, and it even configured UFW for me (gee thanks!) No password, owned within seconds of install. :/
OroPla 2mo ago
Maybe that is why so many things live in Excel instead of a proper database. Security at the expense of convenience does come at the expense of security, after all. Not sure why passwords still exist conceptually. I was hoping we'd move past this annoyance, but instead security has become even more annoying. And all that security with two factor hoops to jump through only for someone to steal your session cookie.
- pixl97 2mo ago
  What would passwords move past too? A device people lose? Some specifications everyone argues about and implements differently. Just look at SAML and everyone using slightly different terminology. Security is more annoying because the attacks are better than ever.
  - OroPla 2mo ago
    Certificates seemed promising there for a while. I also don't mind hardware keys/cards, but when you have to first enter your password, then your pin for your hardware key and then touch the hardware key it gets ridiculous again. Not a fan of biometrics, though, as that cannot be changed trivially. Ideally, authentication should happen like entering a building. You do that _once_ at the beginning of a day by swiping your card or unlocking a door and then it is done and you are never asked to do it again for the rest of the day. I don't have to enter a password and a pin for my key to open the door to either my office or my home. Sure, it might be trivial for an attacker to enter the building using different means, but that hasn't prompted us to play security theater around every building entrance.
    - pixl97 2mo ago
      >but that hasn't prompted us to play security theater around every building entrance Um, then you're just not going into any secured buildings. There are places where you must always have a badge showing. Or, you must always be with another known member of staff keeping an eye on you. Often these places have locks on every door with access levels. It really just sounds like you're a bit less experienced with security in this case.

dwedge 2mo ago

Maybe it's distro specific but I'm fairly sure mysql by default installed with skip networking around 2012, and with bind-address set to localhost since then. Also the root user is only configured from local by default but I'm not sure if that was true 14 years ago. If the defaults are more secure than your examples, it's not fair to blame the database or the defaults. And personally I hate it when software forces security requirements on me. Maybe I don't need an admin password. It's one reason I gave up on selfhosted gitlab - there was no option to reduce password complexity for my users, and those users were only connecting from the local network. The other reason being that it spammed 100GB of logs in a month and was using 11GB of RAM before I'd even gotten around to setting up the first repo.

dylan604 2mo ago
Most software matures to the point that sane defaults get set. In the early days, one could be forgiven for making MVP as the security and attack vectors were still growing. Now that attacks have matured, and new software that is released without mitigation of these mature risks is just dumb and lazy and deserve no forgiveness for being released that way.
z3t4 2mo ago
You should use a user directory (AD) and then use single sign on (SSO) or or the like. It feels kinda stupid at first, but when you have many users and many apps the AD will make life easier and with SSO users can sign in with one click of a button.
danudey 2mo ago
MySQL installed with skip-networking was very common, but as soon as you need to access it over the network (e.g. when you move from one box with MySQL and PHP to one for each) then you have to enable networking and everything falls apart. Also, the number of times in my career that I've googled a problem and seen some forum post saying "Oh, just run chmod -R 777 /var/www/wordpress/uploads/ and it'll fix that" "Great it worked thanks!" tells me that it's the blind leading the blind out there and I'm sure there's tons of forum posts telling people how to disable authentication on their MySQL and disable iptables on their server so that their PHP app can connect to the DB without a password.
- chanux 2mo ago
  It's surprisingly hard to convince supposedly trained tech professionals that `chmod -R 777 /path/to/whadever` is not a good habit.
  - dwedge 2mo ago
    Or curl https://hopefullyatleasthttps.com https://hopefullyatleasthttps.com | sudo bash
brendoelfrendo 2mo ago
I guess I'm confused; why would you, as an admin, want to allow your users to use less secure passwords? I get that your argument is that all traffic is local and so complex passwords are unnecessary (debatable, I would hold that a strong password policy would still be desirable for defense-in-depth, depending on the network and risk profile), but that doesn't make them undesirable.
- dwedge 2mo ago
  We were in the middle of setting everything up company wise (for just two of us), didn't have the password manager yet and I was dictating the password to them. It might be a stupid use case, I agree, but not unreasonable. I didn't say strong passwords are undesirable I said forcing the admin of self hosted software to have to use strong passwords with not even a --yes-im-stupid flag is undesirable
tredre3 2mo ago
> selfhosted gitlab - there was no option to reduce password complexity for my users Gitlab's default requirements aren't that intense, but you can make them more stringent if you want. https://docs.gitlab.com/user/profile/user_passwords/#password-requirements https://docs.gitlab.com/user/profile/user_passwords/#passwor... I guess your goal was to allow users to have 4 character passwords, i.e. "love." which afaik you can't do.
- dwedge 2mo ago
  They must have changed that or I was completely off base because I was just trying to remove special characters and drop it from 12 (I think) and I saw them close a feature request saying they didn't think they should support it. It's possible I misunderstood and the feature request was as you say

redsocksfan45 2mo ago

[dead]

com2kid 2mo ago

I got bit by this with redis a couple years ago. The default install on my VPS's distro had it open to the world by default, and it even configured UFW for me (gee thanks!) No password, owned within seconds of install. :/

OroPla 2mo ago

Maybe that is why so many things live in Excel instead of a proper database. Security at the expense of convenience does come at the expense of security, after all. Not sure why passwords still exist conceptually. I was hoping we'd move past this annoyance, but instead security has become even more annoying. And all that security with two factor hoops to jump through only for someone to steal your session cookie.

pixl97 2mo ago
What would passwords move past too? A device people lose? Some specifications everyone argues about and implements differently. Just look at SAML and everyone using slightly different terminology. Security is more annoying because the attacks are better than ever.
- OroPla 2mo ago
  Certificates seemed promising there for a while. I also don't mind hardware keys/cards, but when you have to first enter your password, then your pin for your hardware key and then touch the hardware key it gets ridiculous again. Not a fan of biometrics, though, as that cannot be changed trivially. Ideally, authentication should happen like entering a building. You do that _once_ at the beginning of a day by swiping your card or unlocking a door and then it is done and you are never asked to do it again for the rest of the day. I don't have to enter a password and a pin for my key to open the door to either my office or my home. Sure, it might be trivial for an attacker to enter the building using different means, but that hasn't prompted us to play security theater around every building entrance.
  - pixl97 2mo ago
    >but that hasn't prompted us to play security theater around every building entrance Um, then you're just not going into any secured buildings. There are places where you must always have a badge showing. Or, you must always be with another known member of staff keeping an eye on you. Often these places have locks on every door with access levels. It really just sounds like you're a bit less experienced with security in this case.