3 ms·

Before I even get to the tone of this bug report, I'd like to ask the guy who made it - are you aware you just put many many users in risk here? Besides making

Before I even get to the tone of this bug report, I'd like to ask the guy who made it - are you aware you just put many many users in risk here? Besides making their services unavailable, this might lead to further exploits. There is a way to disclose this sort of stuff. This is not it. Now, about the tone - be a human first, programmer second. Even though it seems 10gen screwed up big time, everyone makes mistakes. You could inform them of what seems to be a major issue privately and politely, not ridicule them in public. I wouldn't want it done to me and I'm sure neither would you. As said by Chazal (old timey Jewish scholars): "Proper behavior precedes the Torah ... and whoever humiliates another, it is as though he killed him" EDIT: I'd just like to add that among the companies affected by this disclosure and which are now totally open to attack are Craiglist, Firebase, MTV, SourceForge, Codecademy and others. Here's the full list - http://www.mongodb.org/about/production-deployments/ http://www.mongodb.org/about/production-deployments/

tokenizerrr 13y ago
He found a bug, and posted to the bug tracker. Would you have preferred he just shared this with his buddies to crash servers, or attempt to sell it?
- MichaelAza 13y ago
  When you find a bug which amounts to a security vulnerability, you should inform them privately and then make it public after a reasonable amount of time has passed and preferably after it's been fixed. By making it public right from the get-go, anyone who sees this bug report can now attack any system that uses MongoDB. Do you think that's OK?
  - CJefferson 13y ago
    Is it the height of professionalism? No. However, I've written similarly irate messages at 4 or 5am, particularly after spending months working on a product. And this level of coding quality is unacceptable in any product which wants to be large-scale deployed on the internet.
    - MichaelAza 13y ago
      It is beyond unprofessional, it's down right dangerous. Obviously the guy is not a security researcher so he's probably not aware of proper disclosure protocol but seeing as he's fully aware this bug is exploitable ("Step 8. REALIZE I CAN CRASH 99% OF ALL WEB 3.9 SHIT-TASTIC WEBSCALE MONGO-DEPLOYING SERVICES WITH 16 BYTE POST") doing it this way is really not excusable, no matter how pissed you are.
      - sp332 13y ago
        Anyone looking for this vulnerability could run a static analyzer on the MongoDB codebase and they would have found this bug already.
        MichaelAza 13y ago
        Think of it this way - a professional might have done what you're suggesting. Now, any script kiddie can exploit it.
  - PeterisP 13y ago
    It's not optimal, but it's certainly allowed/ok, and it's far better than NOT posting that in the bugreport forum. Proper disclosure takes effort. The product owner can offer bounties to motivate others to make that effort for them. But if you can't/won't spend that effort, then it's still better to publish the bug than not publish it.
    - MichaelAza 13y ago
      I agree proper disclosure take effort but even if he was to send them the very same text privately instead of posting it to the bug tracker it would have been better.
      - Garoof 13y ago
        Maybe if it's only about getting some bug fixed as soon as possible. But I'd say communicating the "MongoDB is terrible" part of it to the public is pretty valuable too. Because nice to know and the hype doesn't mention that so much. I'm sure we can come up with a best way to go about things. I'm not really cool with the "oh Mike" part of it. But I think it's mostly okayish. Certainly a lot more okay than the bug.
ctz 13y ago
Disagree. Users ultimately are put at risk by shipping broken code. Everything after that doesn't increase risk, but it might realise that risk.
bcoates 13y ago
The tone argument is a distraction, but thank you for pointing out the real problem here: this is an irresponsible way to disclose an issue that hurts people whose only mistake was using MongoDB in production. It's not hard to find out how to report security issues to 10gen: http://docs.mongodb.org/manual/administration/vulnerability-notification/ http://docs.mongodb.org/manual/administration/vulnerability-... and the terms they ask for look reasonable to me.
brudgers 13y ago
"be a human first" Dehumanization creates more harm than ten thousand crashing web apps. Packaging the evil as the wisdom of religious scholarship changes nothing. Refined words and moralizing demeanor but gilly suit vileness and violence.
- MichaelAza 13y ago
  You know what, you're right. I shouldn't have used "be a human" there. Haven't thought of it that way. Even so, I still stand by the message even if the wording was wrong - one should be a human first in the sense that one should be empathetic and strive to be good. And yes, I still stand by the quote from Chazal which, even as an atheist, I appreciate as a part of my cultural heritage. All it's saying is that being a good person is more important than anything (even studying the Torah) and that one should not humiliate others. I think those are important and valid messages.
- PommeDeTerre 13y ago
  There's no place for political correctness when it comes to developing critical software systems. Databases are such a system. They're expected to attain and maintain an extremely high level of quality and reliability. Those who build them should expect to do everything in their power to avoid flaws, and these people should be more than willing to accept harsh reprisals when issues are found. When the security and safety of data is at risk, some developer's hurt feelings should be the last thing anyone is concerned about. There are far more pressing problems at hand in such a situation.
  - brudgers 13y ago
    Decryong the expression of humanist values as "political correctness" is the political correctness of those who hold to a different value system. The forum in which we are dialoguing is not the MongoDB IRC. It is HN. The effects of dehumanizing those who do not share our background are well documented by history. They extend well beyond hurt feelings.
  - rtpg 13y ago
    In this instance being an asshole required more effort than being "politically correct" (aka acting like you would if you were in front of the person).
PommeDeTerre 13y ago
People building software systems, especially ones that are public-facing or otherwise widely accessible, have a responsibility to not use components that are questionable. In my opinion, MongoDB is a questionable component. A few years ago, when it was really hyped beyond belief, I think that anyone with at least some database experience, and who could look at it objectively, was inherently suspicious of MongoDB. There were, and clearly still are, just too many things that are disconcerting about it. These range from how it rejects much of the proven knowledge and experience gained over the past four decades, right down to the community who embraced it and the people who hyped it the most. Thankfully, many of us saw this, and we stood against the use of MongoDB and other unsuitable NoSQL "databases" for the projects we work on, or within the organizations we may work for. While it is unfortunate if others suffer as a result of this bug, I can't help but feel that they should have known better than to use MongoDB in the first place. The unease and skepticism should've been there. Given the numerous other proven and reliable DBs, including free and open source ones, there's really no reason to have used MongoDB, in my mind.

tokenizerrr 13y ago

He found a bug, and posted to the bug tracker. Would you have preferred he just shared this with his buddies to crash servers, or attempt to sell it?

MichaelAza 13y ago
When you find a bug which amounts to a security vulnerability, you should inform them privately and then make it public after a reasonable amount of time has passed and preferably after it's been fixed. By making it public right from the get-go, anyone who sees this bug report can now attack any system that uses MongoDB. Do you think that's OK?
- CJefferson 13y ago
  Is it the height of professionalism? No. However, I've written similarly irate messages at 4 or 5am, particularly after spending months working on a product. And this level of coding quality is unacceptable in any product which wants to be large-scale deployed on the internet.
  - MichaelAza 13y ago
    It is beyond unprofessional, it's down right dangerous. Obviously the guy is not a security researcher so he's probably not aware of proper disclosure protocol but seeing as he's fully aware this bug is exploitable ("Step 8. REALIZE I CAN CRASH 99% OF ALL WEB 3.9 SHIT-TASTIC WEBSCALE MONGO-DEPLOYING SERVICES WITH 16 BYTE POST") doing it this way is really not excusable, no matter how pissed you are.
    - sp332 13y ago
      Anyone looking for this vulnerability could run a static analyzer on the MongoDB codebase and they would have found this bug already.
      - MichaelAza 13y ago
        Think of it this way - a professional might have done what you're suggesting. Now, any script kiddie can exploit it.
- PeterisP 13y ago
  It's not optimal, but it's certainly allowed/ok, and it's far better than NOT posting that in the bugreport forum. Proper disclosure takes effort. The product owner can offer bounties to motivate others to make that effort for them. But if you can't/won't spend that effort, then it's still better to publish the bug than not publish it.
  - MichaelAza 13y ago
    I agree proper disclosure take effort but even if he was to send them the very same text privately instead of posting it to the bug tracker it would have been better.
    - Garoof 13y ago
      Maybe if it's only about getting some bug fixed as soon as possible. But I'd say communicating the "MongoDB is terrible" part of it to the public is pretty valuable too. Because nice to know and the hype doesn't mention that so much. I'm sure we can come up with a best way to go about things. I'm not really cool with the "oh Mike" part of it. But I think it's mostly okayish. Certainly a lot more okay than the bug.

ctz 13y ago

Disagree. Users ultimately are put at risk by shipping broken code. Everything after that doesn't increase risk, but it might realise that risk.

bcoates 13y ago

The tone argument is a distraction, but thank you for pointing out the real problem here: this is an irresponsible way to disclose an issue that hurts people whose only mistake was using MongoDB in production. It's not hard to find out how to report security issues to 10gen: http://docs.mongodb.org/manual/administration/vulnerability-notification/ http://docs.mongodb.org/manual/administration/vulnerability-... and the terms they ask for look reasonable to me.

brudgers 13y ago

"be a human first" Dehumanization creates more harm than ten thousand crashing web apps. Packaging the evil as the wisdom of religious scholarship changes nothing. Refined words and moralizing demeanor but gilly suit vileness and violence.

MichaelAza 13y ago
You know what, you're right. I shouldn't have used "be a human" there. Haven't thought of it that way. Even so, I still stand by the message even if the wording was wrong - one should be a human first in the sense that one should be empathetic and strive to be good. And yes, I still stand by the quote from Chazal which, even as an atheist, I appreciate as a part of my cultural heritage. All it's saying is that being a good person is more important than anything (even studying the Torah) and that one should not humiliate others. I think those are important and valid messages.
PommeDeTerre 13y ago
There's no place for political correctness when it comes to developing critical software systems. Databases are such a system. They're expected to attain and maintain an extremely high level of quality and reliability. Those who build them should expect to do everything in their power to avoid flaws, and these people should be more than willing to accept harsh reprisals when issues are found. When the security and safety of data is at risk, some developer's hurt feelings should be the last thing anyone is concerned about. There are far more pressing problems at hand in such a situation.
- brudgers 13y ago
  Decryong the expression of humanist values as "political correctness" is the political correctness of those who hold to a different value system. The forum in which we are dialoguing is not the MongoDB IRC. It is HN. The effects of dehumanizing those who do not share our background are well documented by history. They extend well beyond hurt feelings.
- rtpg 13y ago
  In this instance being an asshole required more effort than being "politically correct" (aka acting like you would if you were in front of the person).

PommeDeTerre 13y ago

People building software systems, especially ones that are public-facing or otherwise widely accessible, have a responsibility to not use components that are questionable. In my opinion, MongoDB is a questionable component. A few years ago, when it was really hyped beyond belief, I think that anyone with at least some database experience, and who could look at it objectively, was inherently suspicious of MongoDB. There were, and clearly still are, just too many things that are disconcerting about it. These range from how it rejects much of the proven knowledge and experience gained over the past four decades, right down to the community who embraced it and the people who hyped it the most. Thankfully, many of us saw this, and we stood against the use of MongoDB and other unsuitable NoSQL "databases" for the projects we work on, or within the organizations we may work for. While it is unfortunate if others suffer as a result of this bug, I can't help but feel that they should have known better than to use MongoDB in the first place. The unease and skepticism should've been there. Given the numerous other proven and reliable DBs, including free and open source ones, there's really no reason to have used MongoDB, in my mind.