Hacker News Reader

Comment by haolez | Hacker News Reader

From the original article, it seems to be ElasticSearch again. Why do so many companies expose ES to the open internet?

Terrible defaults, and stuff like this: https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-...

I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me.

> I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me.

Security is an enterprise feature. Dealing with this now trying to enable SAML in a few SaaS apps, for example.

It's not just locked behind the X-Pack...if you choose a trial, it works. Then, when the trial expires, poof...it's wide open. Surely there's a better way to handle that.

Wow is this true? Instead of disabling access or shut down the db server they simply removed authentication and left the db wide open when trial expires?

Was true in 2017. It has apparently been fixed since.

As horrible at it sounds, it's just business. Large companies have a checklist that databases MUST be protected by authentication, so they always pay for the enterprise edition just to get authentication, and corollary the only way as a software editor to get money is to have authentication behind a pay wall.

Sure, but fail "circuit open", not closed.

I was at a conference, last May I think, where an Elastic employee presented about exactly this topic (insecure defaults in database systems). If I remember correctly, they changed it from a commercial offering to secure by default now (before that talk already I'm pretty sure).

Instead of bothering him/the rest of the audience I left it be (was probably from before his time), but yes, I was also wondering why security was part of the commercial offering...

Anyway, past be past, this is no excuse in 2019 anymore (even if I will be hesitant with Elastic Co in the future).

Like with the last leak a few days ago, I repeat my point: I also blame ES for this as it doesn't enforce authentication. ES people just keep blaming the people who set up those instances ("well duh it should not be facing the public internet") but after we see incident after incident, as a reasonable dev you should try to do your part to make the world a better place. Yes, you were not the one who set up the instance personally, but is it so hard to move a little bit in the direction of "hey a lot of personal information of uninvolved people gets leaked over and over again because of our defaults that stupid admins don't change. Maybe to protect the innocent, we can make ES to require some authentication method to be configured."

Nope. No such thing, no empathy for the people affected by the leaks, all blame shifted, done.

Reply on news.ycombinator.com