MongoDB is the premier example [1] of why software should be "secure by default" [2].
1. https://hn.algolia.com/?query=mongodb%20unsecured&sort=byPop...
1. https://hn.algolia.com/?query=mongodb%20unsecured&sort=byPop...
> Security by default, in software, means that the default configuration settings are the most secure settings possible, which are not necessarily the most user friendly settings.
The hard part is making it both secure by default but also developer (user) friendly.
If you make it so that it is super secure by default, but onerous just to get your product setup because of all the security overhead developers are going to get frustrated and either disable all the security or use a competitor's (less secure) product that is easier to setup and you are back at square one.
There are so many options out there that if you try to launch a product (DB, webserver, etc.) and it's really hard for the developer to get started ("step 1, before you can try out this webserver, first register an account with Let's Encrypt") nobody is going to use it.
It's not an easy problem to solve because people are inherently lazy and want results fast. Security done right is the opposite of that in its current state.
But MongoDB is web scale! Nobody is going to run it on localhost only! So the default (until 2.6) was to listen on all interfaces by default. AFAIK Elasticsearch still listens on all interfaces by default. Does this choice make life any easier for the developer who is just beginning to learn how to use it? I dunno, most of my development work takes place on localhost. I probably won't even notice if a newly installed database only listens on localhost.