Hacker News Reader

Comment by tyingq | Hacker News Reader

Terrible defaults, and stuff like this: https://discuss.elastic.co/t/ransom-attack-on-elasticsearch-...

I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me.

> I will never understand why basic authentication in ES was locked behind a X-Pack license. That's always seemed absolutely bonkers to me.

Security is an enterprise feature. Dealing with this now trying to enable SAML in a few SaaS apps, for example.

It's not just locked behind the X-Pack...if you choose a trial, it works. Then, when the trial expires, poof...it's wide open. Surely there's a better way to handle that.

Wow is this true? Instead of disabling access or shut down the db server they simply removed authentication and left the db wide open when trial expires?

Was true in 2017. It has apparently been fixed since.

As horrible at it sounds, it's just business. Large companies have a checklist that databases MUST be protected by authentication, so they always pay for the enterprise edition just to get authentication, and corollary the only way as a software editor to get money is to have authentication behind a pay wall.

Sure, but fail "circuit open", not closed.

I was at a conference, last May I think, where an Elastic employee presented about exactly this topic (insecure defaults in database systems). If I remember correctly, they changed it from a commercial offering to secure by default now (before that talk already I'm pretty sure).

Instead of bothering him/the rest of the audience I left it be (was probably from before his time), but yes, I was also wondering why security was part of the commercial offering...

Anyway, past be past, this is no excuse in 2019 anymore (even if I will be hesitant with Elastic Co in the future).

Reply on news.ycombinator.com