Hacker News Reader

Comment by ljm | Hacker News Reader

https://github.com/bloomberg/blazingmq/blob/93e6426d474a4293...

Not sure where they are on the roadmap but authentication in particular is 'mid-term' but lacks detail.

I expect that if you want to deploy this then you're doing it on an internal network; its deployment examples are based on Docker so I expect it's relying on what you can do with k8s.

View on HN

Thanks! That is the sort of stuff I was asking about.

It looks like it's an after thought but at least on their mind now, which is very fair with respect to Bloomberg's wants/needs. It'd be nice if they had a bit of a warning about using this until it has some basic auth(n) and TLS since they're releasing it to the public. I think it is, relativley speaking, rude to release insecure networked software without giving users a notice as to what sorts of insecurity is at least known/expected.

Adding a veneer of security isn't necessarily superior to leaving it out altogether. Systems of this sort are best secured at the network level, i.e. only trusted hosts should be able to connect to it. Redis is a good example of where this has been tried: it does support password based log in, but the password is stored and transmitted in plaintext, and a redis server will happily accept thousands of auth attempts per second making brute forcing a viable attack. Rather than improve the auth system Redis has instead doubled down on encouraging appropriate network level security by defaulting to only being accessible to the local host, so admins have to go through an explicit step (with warnings) before they can just expose it to the internet.

> I think it is, relativley speaking, rude to release insecure networked software

And if you believe that, you're wrong

Reply on news.ycombinator.com