6 ms·
Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.
by pietroglyph 6y ago
Sounds like a good public service. I’d much rather have my data deleted until it’s secured than have it stolen by someone else.
- cryptoz 6y agoVandalism is not a good public service. > I’d much rather have my data deleted until it’s secured than have it stolen by someone else There are multiple logical fallacies in this sentence. First is the use of the world 'until' which is ambiguous here; it suggests that your data can be 'undeleted' after the DB has been secured or you would rather not have any data stored anywhere that is not secured. Either option to me seems like an incorrect read of your comment but I'm not sure. And "than have it stolen by someone else" seems to imply that you know that this data was never copied and cannot be stolen still. I think that seems incorrect, unless there is something I missed that assures everyone that the data could not have been stolen during these hacks. Lastly, your personally preferred outcome for your personal data is not a measure for all of society, but you grant it that "public service" label as if your preference matters above everyone else's. You don't know what other people think about their data. You don't know what the data even is. What if some of it was just a hobby project for someone, with no financial implications of unsecured data or of data loss, but with emotional attachment to their data? Do they not matter to you? A blind deletion of unknown data belonging to unknown people is not a public service.
- p1necone 6y agoI assume the comment was partially in jest. But this would actually work well if it was consistent and fast. If databases get wiped before you have time to put anything important in them then noone gets hurt.
- deleted 6y ago[deleted]
- dmurray 6y agoYeah, it's bad for the industry right now, but this is just a transition period! Once we get through the pain of losing a few databases, the new steady state where nobody's data is stored in world-writable databases will be better for everyone, and that will be worth the cost. Consider if this happened five years ago, it would have had a smaller cost than happening today. And it was probably going to happen at some point, so better that it happened five years ago than today. By the same argument, better that it happened now than at any point in the future. I'm not sure how serious I am about this argument but...at least a little bit? I guess the alternative argument is that any day now software vendors would have all moved to secure-by-default platforms where deploying a world-writable Redis in production would have been so difficult that it rarely happened.
- 1337shadow 6y agoIf you have Docker then make sure you have a firewall on top of it, otherwise it will expose pretty much what any docker user wants !
- BrandoElFollito 6y agoWhat do you mean by that?
- Sebb767 6y agoDocker uses it's own iptables rules which have priority over the system ones. Therefore, even if you have an iptables-based firewall blocking all ports, a docker service will still be reachable, unless configured not to be in docker itself.
- BrandoElFollito 6y agoI do not understand what you mean by "priority over the system ones" A docker container can have internal ports exposed explicitly, or use host networking. In any case these are ports exposed by the docker-proxy executable - an executable like any other on the system. Then come the iptables rules of the system (which open or not data flow to the ports exposed by docker-proxy). Or is it different?
- bigiain 6y ago> But this would actually work well if it was consistent and fast. So not too concerned about partition tolerance, huh?
- tudorw 6y agoNo, think about it, stolen or deleted? Which option serves your clients better given the generally awful situation?
- rodgerd 6y agoIf you can't look after people's sensitive data you don't deserve to have it.
- tudorw 6y agoIt can be, imagine I saw a fire alarm and pressed the button because I thought a fire started, it didn't and I learnt that the fire alarm only looked like it was working, knowing that this would not be fixed for 24 hrs I choose to smash the alarm so it's visibly broken. Is that vandalism?
- josejuanisaac 6y agoI completely missed the poor consistency from the "I would rather" comment above. I would also prefer my data deleted and not stolen, but had to read your comment to realize there is no evidence to suggest that. It is funny how much I assume being at least partially aware of my ignorance of the topic.
- nix23 6y ago>Vandalism is not a good public service. It is, better than to steal the data, you know what a really bad service is? Let your Database wide open, and expose your customers data (maybe?) for everyone to read.
- ben509 6y ago> There are multiple logical fallacies in this sentence. No, there aren't any fallacies in that sentence and can't be. The statement expresses a personal preference; to be fallacious there must be some logic that can be unsound. That is, it must start from some premises and then derive a conclusion. To find a fallacy, you have to show that at some point the conclusion does not follow from the premises. Since it's a simple assertion, it is implicitly sound. (The graph of premises to conclusions is just a single node.) And since the author knows with certainty what his preferences are, we can take it as true. It's fruitless to argue with people about what their preferences are. > First is the use of the world 'until' which is ambiguous here Virtually all "fallacies" you see online are just people typing their thoughts in a hurry. Take advantage of interaction and ask them to clarify. > Lastly, your personally preferred outcome for your personal data is not a measure for all of society, but you grant it that "public service" label as if your preference matters above everyone else's. And as a member of the public, if it serves my interest, it is a public service to some extent. Now, fair enough, you're trying to attack it as not being some broader notion of a public service. You have that broader notion in mind, but you don't explain what it is. Instead you apply your internal definition through "as if..." which puts you in the territory of inventing a claim they simply never made. That's not even fallacious, it's pure fiction. > A blind deletion of unknown data belonging to unknown people is not a public service. You do make some claims, mostly coached as questions, that might lead to this conclusion. You never plainly state your premises, nor do you connect them to this conclusion. So after all that, your conclusion is a non sequitur!
- randyrand 6y agodepends on the data. it could be public records
- smt88 6y agoDatabases can be public and secure. If a database can be deleted, it is not secure.
- qrbLPHiKpiux 6y agoGood.
- mhh__ 6y agoOops no welfare for you! I understand that some people won't learn without encouragement but it's not a good thing for all.
- ljm 6y agoThis attack uses public write access, which is how they can delete stuff. I think we can agree that this is not good, and I also think we can agree that a database shouldn't be exposed as-is without an application layer or API on top Ultimately, companies like MongoDB and Elasticsearch are culpable for selling database technology that is insecure by default, presumably because that's the easiest way to boost their metrics for the VC overlords.
- 6y ago