8 ms·
How often are mongo instances exposed to the internet? I'm more of an SQL person and for those I know it's pretty uncommon, but does happen.
by maxrmk 9mo ago
How often are mongo instances exposed to the internet? I'm more of an SQL person and for those I know it's pretty uncommon, but does happen.
- wood_spirit 9mo agoThe article links to a shodan scan reporting 213K exposed instances https://www.shodan.io/search?query=Product%3A%22MongoDB%22 https://www.shodan.io/search?query=Product%3A%22MongoDB%22
- hahahacorn 9mo agoA highly cited reason for using mongo is that people would rather not figure out a schema. (N=3/3 for “serious” orgs I know using mongo). That sort of inclination to push off doing the right thing now to save yourself a headache down the line probably overlaps with “let’s just make the db publicly exposed” instead of doing the work of setting up an internal network to save yourself a headache down the line.
- TZubiri 9mo agoI would have hoped that there would be no important data in mongoDB. But now we can at least be rest assured that the important data in mongoDB is just very hard to read with the lack of schemas. Probably all of that nasty "schema" work and tech debt will finally be done by hackers trying to make use of that information.
- saghm 9mo agoI'd argue that there's a schema; it's just defined dynamically by the queries themselves. Given how much of the industry seems fine with dynamic typing in languages, it's always been weird to me how diehard people seem to be about this with databases. There have been plenty of legitimate reasons to be skeptical of mongodb over the years (especially in the early days), but this one really isn't any more of a big deal than using Python or JavaScript.
- morshu9001 9mo agoYes there's a schema, but it's hard to maintain. You end up with 200 separate code locations rechecking that the data is in the expected shape. I've had to fix too many such messes at work after a project grinded to a halt. Ironically some people will do schemaless but use a statically typed lang for regular backend code, which doesn't buy you much. I'd totally do dynamic there. But DB schema is so little effort for the strong foundation it sets for your code. Sometimes it comes from a misconception that your schema should never have to change as features are added, and so you need to cover all cases with 1-2 omni tables. Often named "node" and "edge."
- saghm 9mo ago> Ironically some people will do schemaless but use a statically typed lang for regular backend code, which doesn't buy you much. I'd totally do dynamic there. I honestly feel like the opposite, at least if you're the only consumer of the data. I'd never really go out of my way to use a dynamically typed language, and at that point, I'm already going to be having to do something to get the data into my own language's types, and at that point, it doesn't really make a huge difference to me what format it used to be in. When there are a variety of clients being used though, this logic might not apply though.
- morshu9001 9mo agoIf you're only consuming, yes. It might as well be a totally separate service. If it's your database that you read/write on, it's closely tied to your code.
- cyberpunk 9mo agoWe just sit a data persistence service infront of mongo and so we can enforce some controls for everything there if we need them, but quite often we don’t. It’s probably better to check what you’re working on than blindly assuming this thing you’ve gotten from somewhere is the right shape anyway.
- 9mo ago
- bigbuppo 9mo agoWhatever horrors there are with mongo, it's still better than the shitshow that is Zope's ZODB.
- bostik 9mo agoThere is a surprising amount of important data in various Mongo instances around the world. Particularly within high finance, with multi-TB setups sprouting up here and there. I suspect that this is in part due to historical inertia and exposure to SecDB designs.[0] Financial instruments can be hideously complex and they certainly are ever-evolving, so I can imagine a fixed schema for essentially constantly shifting time series universe would be challenging. When financial institutions began to adopt the SecDB model, MongoDB was available as a high-volume, "schemaless" KV store, with a reasonably good scaling story. Combine that with the relatively incestuous nature of finance (they tend to poach and hire from within their own ranks), the average tenure of an engineer in one organisation being less than 4 years and you have an osmotic process of spreading "this at least works in this type of environment" knowledge. Add the naturally risk-averse nature of finance[ß] and you can see how one successful early adoption will quickly proliferate across the industry. 0: This was discussed at HN back in the day too: https://calpaterson.com/bank-python.html https://calpaterson.com/bank-python.html ß: For an industry that loves to take financial risks - with other people's money of course, they're not stupid - the players in high finance are remarkably risk-averse when it comes to technology choices. Experimentation with something new and unknown carries a potentially unbounded downside with limited, slowly emerging upside.
- matwood 9mo ago> A highly cited reason for using mongo is that people would rather not figure out a schema. Which is such a cop out, because there is always a schema. The only questions are whether it is designed, documented, and where it's implemented. Mongo requires some very explicit schema decisions, otherwise performance will quickly degrade.
- xnorswap 9mo agoFowler describes it as Implicit vs Explicit schema, which feels right. Kleppmann chooses "schema-on-read" vs "schema-on-write" for the same concept, which I find harder to grasp mentally, but describes when schema validation need occur.
- petcat 9mo agoFrom my experience, Mongo DB's entire raison d'etre is "laziness". * Don't worry about a schema. * Don't worry about persistence or durability. * Don't worry about reads or writes. * Don't worry about connectivity. This is basically the entire philosophy, so it's not surprising at all that users would also not worry about basic security.
- aragilar 9mo agoNot only that, but authentication is much harder than it needs to be to set up (and is off by default).
- winrid 9mo agoAlthough interestingly, for all the mongo deployments I managed, the first time I saw a cluster publicly exposed without SSL was postgres :)
- ddtaylor 9mo agoUltimate webscale!
- Thaxll 9mo agoMost of your points are wrong. Maybe only 1- is valid'ish.
- morshu9001 9mo agoI'm sure there are publicly exposed MySQLs too
- zX41ZdbW 9mo agoThere are many more exposed MySQLs than MongoDBs: https://www.shodan.io/search?query=mongodb https://www.shodan.io/search?query=mongodb https://www.shodan.io/search?query=mysql https://www.shodan.io/search?query=mysql https://www.shodan.io/search?query=postgresql https://www.shodan.io/search?query=postgresql But this must be proportional to the overall popularity.
- senderista 9mo ago
- ok123456 9mo agoFor a long time, the default install had it binding to all interfaces and with authentication disabled.
- notepad0x90 9mo agooften. lots of data leaks happened because of this. people spin it up in a cloud vm and forget it has a public ip all the time.
- ddtaylor 9mo agoIt could be because when you leave an SQL server exposed it often turns into much worse things. For example, without additional configuration, PostgreSQL will default into a configuration that can own the entire host machine. There is probably some obscure feature that allows system process management, uploading a shell script or something else that isn't disabled by default. The end result is "everyone" kind of knows that if you put a PostgreSQL instance up publicly facing without a password or with a weak/default password, it will be popped in minutes and you'll find out about it because the attackers are lazy and just running crypto-mine malware, etc.
- bschmidt107979 9mo ago[dead]
- Capricorn2481 9mo agoWhat they wrote was pretty benign. They just asked how common it is for Mongo to be exposed. You seem to have taken that as a completely different statement
- bschmidt107979 9mo ago[dead]
- Capricorn2481 9mo agoThey did not say it's rarely used at all.
- ch2026 9mo agoBecause nobody uses mongo for the reasons you listed. They use redis, dynamo, scylla or any number of enriched KV stores. Mongo has spent its entire existence pretending to be a SQL database by poorly reinventing everything you get for free in postgres or mysql or cockroach.
- yearolinuxdsktp 9mo agoFalse. Mongo never pretended to be a SQL database. But some dimwits insisted on using it for transactions, for whatever reason, and so it got transactional support, way later in life, and in non-sharded clusters in the initial release. People that know what they are doing have been using MongoDB for reliable horizontally-scalable document storage basically since 3.4. With proper complex indexing. Scylla! Yes, it will store and fetch your simple data very quickly with very good operational characteristics. Not so good for complex querying and indexing.
- bschmidt107979 9mo ago[dead]
- _lvbh 9mo agoMy university has one exposed to the internet, and it's still not patched. Everyone is on holiday and I have no idea who to contact.
- bschmidt107979 9mo ago[dead]
- heavyset_go 9mo agoNo one, if you aren't in the administration's good graces and something shitty happens unrelated to you, you've put a target on your back to be suspect #1.