This refers to publicly listing on the stock exchange, as opposed to last time Mongo DBs went public: https://nakedsecurity.sophos.com/2017/01/11/thousands-of-mon...
I know jokes on HN are risky, but this was both kinda funny and somewhat accurate.
That meant anyone could connect over HTTP and get your data.
From the article:
The problem for MongoDB users seems to be that on some systems the default configuration has the database listening on a publicly accessible port as soon as it’s installed. Users are supposed to read the manual and set up access control and authentication after installing the software but it seems that plenty of them don’t.
I think that counts.
Yes of course, users are always responsible.
That doesn't mean shipping a product with zero default security was a sensible thing either. I'd note that other database vendors don't do this.
User error is a guarantee, and great software minimizes the paths to an error and also eliminates classes of error that are easy to eliminate.
- Command line login never works, you have to get into Mongo shell, then authenticate.
- Attaching multiple db permissions to one user has all kinds of gotchas to: I have to switch to each database and re-auth instead of just authing to the user and then switching DBs without further auth.
None of it works intuitively.