Hacker News Reader

Or why is it so hard to enable authentication at all?

Or why enable flags that allow to loose data without warnings in many common circumstances?

Don't expect anything from mongo. Don't trust mongo. Don't use mongo.

This might be useful https://docs.mongodb.com/v3.2/administration/security-checkl...

(But let's say binding on 0.0.0.0 or not having a firewall in the system are not only their fault)

In the same way people can trust local addresses in Pgsql

They have improved a few things. The new versions of MongoDB don't bind to the public interface and they have the capacity for authentication (unlike the early releases). I believe this is why the most popular versions of unauthenticated MongoDB are the 2.x versions:

https://blog.shodan.io/its-still-the-data-stupid/

Maybe that would hurt their "get started easily" proposition, which was very imporant to get them where they are now.

yeah but now they're there, with a big built in base of people who don't want to stop selling their skills. So they can make a new get started securely proposition.

But it's always "grow or die"