Hacker News Reader

So yeah, that means roughly 80% percent of the sites on the internet will be affected, but not the 20% that employ competent, well staffed infosec teams. Good to know :)

Seriously though, almost every vulnerability that gets disclosed can have the "this is all overblown, and any security minded company won't have this problem", and yet we are all dealing with the long tail of malicious software and services hosted on vulnerable infrastructure...

View on HN

You don't need a large specialized infosec team to know the following:

* Don't give SUPER or FILE privs to your application's mysql user

* Don't allow mysql to accept connections from the public internet

* Avoid SQL injection through use of bind variables

This is pretty elementary stuff, and just doing any 2 of the 3 above will prevent this exploit from being usable. (unless the attacker has SSH access to your hosts, but in that case, you should already consider your entire environment to be compromised.)

Reply on news.ycombinator.com