"NoSQL, or rather NoAuthentication, has been a huge gift to the hacker community. Just when I was worried that they'd finally patched all of the authentication bypass bugs in MySQL, new databases came into style that lack authentication by design."
From his account of the Hacking Team Hack, worth a read if you missed it.
Step 2) Write {NewSoftwarePackage} that does most of what {OldSoftwarePackage} did + X
Step 3) Spend an order of magnitude more time than expected finishing Y, which turns out to actually be rather hard because {Messy Real World Engineering Details}
Step 4) Never get to Z & eventually come up with a narrative about how Z was stupid anyway
Things like Elasticsearch not having even a basic password (esp since it's HTTP so it's trivial) is simply silly. And it's probably not a good idea to support no-auth connections at all - if it's really a hassle, just set the user/pass to the host name.
Yea. I found that surprising when it came time to use ElasticSearch for my own purposes. If you want security, you need to setup something between the ElasticSearch server and the clients to moderate.
But yes, the fact that it is open OOTB is frustrating.