25% of mongodb installs externally accessible lack a fucking password on the admin account.
They deserve it. Maybe it will teach them something.
Then there is the fact that MongoDB is known for having a very bad reputation among software engineers. I could personally write down many horror stories that I experienced myself, plus all the things you get to hear from friends and tech blogs.
Maybe after this attack some companies ban it from their software stacks. I really hope they do so. The world would be a better place without MongoDB.
No. Just.. no.... Security of YOUR system is YOUR responsibility.
> In a world where software stacks have multiple applications, programming languages and databases, it happens that people are not experts in everything.
Hire one.
> Maybe after this attack some companies ban it from their software stacks.
Or maybe decision makers realise that yes, you do need to pay for skills.
My thoughts exactly.
I think it is extremely unfortunate that financial incentives are currently stacked against engineering responsibly -- a startup that tries to actually secure a well-built product will need to spend an often unaffordable amount of money or time doing so.
I tried search for me info, but could find anything. Was this the default? Procedure given in a popular tutorial? It seems pretty insane.
