Hacker News Reader

This needs auth with a randomly generated password by default. Standing up products like this is exactly how data breaches happen, it’s effectively sql injection as a feature.

View on HN

Exactly, more generally I'm thinking of a way for Soul to be extendable via plugins, which one of the most important one is authentication / authorization and permissions level.

as a default

Yeah it's reasonable.

If you use this as your production database on the public internet that’s entirely on you. It’s the same issue people have with Redis.

If we are talking of RESTful servers and mention Redis, then we should mention Webdis, which is a RESTful server for Redis -- and it has ACL. https://webd.is/ It is a very old but still active project.

That’s like saying cars don’t need airbags because people should drive responsibly.

Edit: case study: Optus, who leaked pii due to an unauthenticated api intended for internal use only but accidentally exposed to the internet.

I hadn't heard that about the Optus leak. Do you have a link with further details?

I’m sure google would, it was headline news aus wide for over a week.

Reply on news.ycombinator.com