Hacker News Reader

Comment by kevincox | Hacker News Reader

This is why I try to put everything behind NGINX with basic auth. Unfortunately not everything works well that way but in this case I suspect that this is made unexploitable by anyone without the password.

View on HN

Ha, I was just about to go in here and say the same thing.

"Fortunately" some "white hat" hacker contacted us last year about another Metabase exploit. I gave him a 30 USD tip and ended up doing exactly what you are suggesting.

Now I'm glad that means I don't need to interrupt my vacation to fix this thing right now.

Here in Italy you get lucky if the company is not suing you :(

EDIT: I misunderstood.

We have the same

https://www.zeit.de/digital/datenschutz/2021-08/cdu-connect-...

I thought gp was talking abhobt their employer suing them for bugs they created.

That’s simply not true, sadly; you’re very much reliant on the company not attempting to sue you. Counter examples (not implying these have been successful, but it is also not unheard of to have the police show up at your door and collect all computers/phones etc. to investigate)

- https://www.golem.de/news/connect-app-cdu-verklagt-offenbar-... - https://www.heise.de/news/Modern-Solution-Anklage-gegen-Aufd...

Hmm, I was thinking that's a standard thing, atleast in HN crowd. basic setup Cloudflare -> Nginx -> Docker -> 3rd Party app, all on a dedicated vm

You can also setup some reverse proxies to auth with SSO like Google. I use Traefik + https://github.com/thomseddon/traefik-forward-auth for personal projects, even on my local network.

I like NGINX, but I prefer how simple it is to set up Caddy with basic auth. Caddy is already simpler to configure (and has automatic SSL via Let's Encrypt), but it's so simple to get its basic directive working compared to NGINX that I do it by default now.

Better yet, oauth2-proxy in case of an organization: only admins need to know the secrets, every user simply uses SSO to get access.

or vpn

Reply on news.ycombinator.com