Hacker News Reader

Even on localhost, you should still use auth. One shouldn't naively assume someone can't break into your server.

Yes. But by default things should not be open to anything but your machine.

So let’s start blaming every piece of software that listens to localhost, but is exposed by docker.

Not a fan of mongo, but the defaults are way better than before.

Docker needs to fix their defaults

If someone breaks into your server, database Auth won't protect you. And you have to reinstall everything including your database just to be sure he didn't leave holes in those.

And the hacker can still delete your database or steal your data. He will simply download the datafiles and then delete those data from the server. Drop database done without a database password. And no, databases aren't kept encrypted on the server.

Not necessarily -- there can be a number of reasons one can access localhost over the loopback interface that does _not_ imply root access: SSRF, misconfigured tunnels, or just a plain unpriviliged account where the attacker couldn't perform privilege escalation (either because the attacker's incompetence or the system being up-to-date and/or hardened)

Ok. Then add your password on these system when you design like that. That's not the default as most people feel otherwise.

Reply on news.ycombinator.com