7 ms·

What is the link between MongoDB and them getting hacked?

by eknkc 13y ago

d23 13y ago
MongoDB is the accepted thing to hate around here. That being said, I don't think a schemaless database is really appropriate for carefully considered (or what should be carefully considered) financial data.
- AndyNemmity 13y ago
  Why does MongoDB have a bad reputation here?
  - justinsb 13y ago
    It's been repeatedly discussed (ad nauseam?) - I recommend checking out hnsearch.com. I dislike MongoDB, but if I had to try to summarize objectively: 1) It is marketed very heavily, including to use cases to which it is poorly suited 2) It can be very complicated to run in production, I think because it actually wasn't originally designed to be distributed. 3) It has a history of data loss. I think this is because it generally favors performance over reliability, combined with #1 and #2
  - camus2 13y ago
    MongoDB has been marketed as something it is not ,that's why.
    - doyoulikeworms 13y ago
      Would you care to provide a brief rundown on this? I'm not doubting you. I'm simply ignorant. What about other NoSQL solutions?
      - fennecfoxen 13y ago
        MongoDB is a clever wrapper to a mmap()'d hash table of linked lists of BSON documents that's naive as anything but fast as long as everything's always in memory. (Well, "fast" is a strong word where Mongo is concerned. "not horribly slow".) MOST other NoSQL solutions actually do things like treat their index differently than their bulk data so that it isn't accidentally swapped out, ruining performance. Many also do important things like supplying durable writes. (Your data may not be consistent at any one given moment, but it'll get there.)
  - gaius 13y ago
    Because it's pure snake oil. If you got an old IMS hacker from the 1970s he would be appalled at just how primitive it is, but to its cult-like followers it is cutting edge tech and they won't shut up about it. I have run it in production, thrown over the fence by some dumb devs who believed the lies that "you don't need a DBA". Well you need a full time team and a lot of hardware, and that's comparing it to Oracle.
dijit 13y ago
MongoDB is not ACID compliant, using it for accounts is like sending off cheques by carrier pigeons.
- Gracana 13y ago
  So all I have to do to secure my data is use an ACID compliant database? Cool!
  - crntaylor 13y ago
    In case it's not clear to you, there are two reasons that you are getting downvoted: 1. snark, and 2. you are committing the logical fallacy of affirming the consequent. [0] In particular, dijit asserted that "Not ACID => Not secure" (which is debatable, but that doesn't matter here) from which you can also validly deduce the contrapositive "Secure => ACID". However, you then (sarcastically) asserted that dijit is saying "ACID => Secure", whereas in fact he said nothing like that. [0] http://en.wikipedia.org/wiki/Affirming_the_consequent http://en.wikipedia.org/wiki/Affirming_the_consequent
    - hack3r_n3ws 13y ago
      I don't think you understand what is being discussed. ACID compliance has nothing to do with "security". It's a matter of transactional guarantees. MongoDB offers none because it is not ACID compliant. That means that transactions can silently fail, partially commit, execute out of order, etc. This is an EXTREMELY serious and complicated issue. And I would not do any banking, trading, etc on a non-compliant database.
      - snupples 13y ago
        Now you're just arguing semantics
      - crntaylor 13y ago
        If it helps, you can replace "Secure" with "X" where X is any adjective, and my argument will still work.
nwh 13y ago
The comment was referencing an anonymous whitehat talking about having hacked an exchange for 100BTC due to way the service was doing their accounting. They'd essentially found a race condition that allowed them to overwrite a large withdrawal with the result of a smaller one, affording them unlimited Bitcoin. It was inferred that this was coinbase, though not directly stated I don't think. http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_roughly_100_btc_from_an_exchange_and/ http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_... Why is MongoDB bad? It's not ACID compliant. It's hard to determine the state of the database with concurrent processes attempting to modify its data. Given the explanation it's fairly clear that it's Coinbase being talked about. http://en.wikipedia.org/wiki/ACID http://en.wikipedia.org/wiki/ACID
- fennecfoxen 13y ago
  From the world of NoSQL, let me nitpick a bit: You don't need to run ACID software to do safe processing of your transactions (durability and clever business-logic constraints can serve to limit your exposure to losses to finite knowable values, which may be worth it because you can achieve availability and partition-tolerance)... but man, ACID sure makes things a heck of a lot easier, and will save you from many classes of implementation error. Think twice before giving it up. Think more than twice. (Also, MongoDB is like the worst NoSQL data store out there for a task like this.)
  - BlackDeath3 13y ago
    Not to start a flame war here, but from the perspective of someone with limited database experience, what is the best database out there? I realize that this question is very vague, but is there a best general-use database?
    - georgemcbay 13y ago
      "Best" is a strong word to use universally, but IMO when in doubt use PostgreSQL. It has a very solid traditional ACID/SQL core and it has also been introducing "NoSQL" style json document storage on top of that for projects that want to go that route. I suspect PostgreSQL will do the the NoSQL type stuff well a a lot sooner than NoSQL databases will do the consistence/durability thing well. Having said all of that on my personal site I actually use RethinkDB because it is delightfully easy to setup and code against (I just persist my Go structs to the db and don't worry about a relational schema to maintain) and I don't really care about data integrity there, so I don't mind that RethinkDB is relatively new and untested. So one size doesn't fit all, but PostgreSQL is still, IMO, generally the "safest bet" if you do care about data integrity and don't want to spend hundreds of thousands of dollars on licensing to scale it up.

What is the link between MongoDB and them getting hacked?

by eknkc 13y ago

What is the link between MongoDB and them getting hacked?

d23 13y ago

MongoDB is the accepted thing to hate around here. That being said, I don't think a schemaless database is really appropriate for carefully considered (or what should be carefully considered) financial data.

AndyNemmity 13y ago
Why does MongoDB have a bad reputation here?
- justinsb 13y ago
  It's been repeatedly discussed (ad nauseam?) - I recommend checking out hnsearch.com. I dislike MongoDB, but if I had to try to summarize objectively: 1) It is marketed very heavily, including to use cases to which it is poorly suited 2) It can be very complicated to run in production, I think because it actually wasn't originally designed to be distributed. 3) It has a history of data loss. I think this is because it generally favors performance over reliability, combined with #1 and #2
- camus2 13y ago
  MongoDB has been marketed as something it is not ,that's why.
  - doyoulikeworms 13y ago
    Would you care to provide a brief rundown on this? I'm not doubting you. I'm simply ignorant. What about other NoSQL solutions?
    - fennecfoxen 13y ago
      MongoDB is a clever wrapper to a mmap()'d hash table of linked lists of BSON documents that's naive as anything but fast as long as everything's always in memory. (Well, "fast" is a strong word where Mongo is concerned. "not horribly slow".) MOST other NoSQL solutions actually do things like treat their index differently than their bulk data so that it isn't accidentally swapped out, ruining performance. Many also do important things like supplying durable writes. (Your data may not be consistent at any one given moment, but it'll get there.)
- gaius 13y ago
  Because it's pure snake oil. If you got an old IMS hacker from the 1970s he would be appalled at just how primitive it is, but to its cult-like followers it is cutting edge tech and they won't shut up about it. I have run it in production, thrown over the fence by some dumb devs who believed the lies that "you don't need a DBA". Well you need a full time team and a lot of hardware, and that's comparing it to Oracle.

dijit 13y ago

MongoDB is not ACID compliant, using it for accounts is like sending off cheques by carrier pigeons.

Gracana 13y ago
So all I have to do to secure my data is use an ACID compliant database? Cool!
- crntaylor 13y ago
  In case it's not clear to you, there are two reasons that you are getting downvoted: 1. snark, and 2. you are committing the logical fallacy of affirming the consequent. [0] In particular, dijit asserted that "Not ACID => Not secure" (which is debatable, but that doesn't matter here) from which you can also validly deduce the contrapositive "Secure => ACID". However, you then (sarcastically) asserted that dijit is saying "ACID => Secure", whereas in fact he said nothing like that. [0] http://en.wikipedia.org/wiki/Affirming_the_consequent http://en.wikipedia.org/wiki/Affirming_the_consequent
  - hack3r_n3ws 13y ago
    I don't think you understand what is being discussed. ACID compliance has nothing to do with "security". It's a matter of transactional guarantees. MongoDB offers none because it is not ACID compliant. That means that transactions can silently fail, partially commit, execute out of order, etc. This is an EXTREMELY serious and complicated issue. And I would not do any banking, trading, etc on a non-compliant database.
    - snupples 13y ago
      Now you're just arguing semantics
    - crntaylor 13y ago
      If it helps, you can replace "Secure" with "X" where X is any adjective, and my argument will still work.

nwh 13y ago

The comment was referencing an anonymous whitehat talking about having hacked an exchange for 100BTC due to way the service was doing their accounting. They'd essentially found a race condition that allowed them to overwrite a large withdrawal with the result of a smaller one, affording them unlimited Bitcoin. It was inferred that this was coinbase, though not directly stated I don't think. http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_roughly_100_btc_from_an_exchange_and/ http://www.reddit.com/r/Bitcoin/comments/1wtbiu/how_i_stole_... Why is MongoDB bad? It's not ACID compliant. It's hard to determine the state of the database with concurrent processes attempting to modify its data. Given the explanation it's fairly clear that it's Coinbase being talked about. http://en.wikipedia.org/wiki/ACID http://en.wikipedia.org/wiki/ACID

fennecfoxen 13y ago
From the world of NoSQL, let me nitpick a bit: You don't need to run ACID software to do safe processing of your transactions (durability and clever business-logic constraints can serve to limit your exposure to losses to finite knowable values, which may be worth it because you can achieve availability and partition-tolerance)... but man, ACID sure makes things a heck of a lot easier, and will save you from many classes of implementation error. Think twice before giving it up. Think more than twice. (Also, MongoDB is like the worst NoSQL data store out there for a task like this.)
- BlackDeath3 13y ago
  Not to start a flame war here, but from the perspective of someone with limited database experience, what is the best database out there? I realize that this question is very vague, but is there a best general-use database?
  - georgemcbay 13y ago
    "Best" is a strong word to use universally, but IMO when in doubt use PostgreSQL. It has a very solid traditional ACID/SQL core and it has also been introducing "NoSQL" style json document storage on top of that for projects that want to go that route. I suspect PostgreSQL will do the the NoSQL type stuff well a a lot sooner than NoSQL databases will do the consistence/durability thing well. Having said all of that on my personal site I actually use RethinkDB because it is delightfully easy to setup and code against (I just persist my Go structs to the db and don't worry about a relational schema to maintain) and I don't really care about data integrity there, so I don't mind that RethinkDB is relatively new and untested. So one size doesn't fit all, but PostgreSQL is still, IMO, generally the "safest bet" if you do care about data integrity and don't want to spend hundreds of thousands of dollars on licensing to scale it up.