There can be multiple victims, multiple causes/threat actors, and overlap between two categories.
But what's the end user a victim of in this case? Other than a brief lack of availability?
Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur.
I don't understand the relevance of this to my original question.
> Of course the behavior of Docker is really problematic in this case, and ditto for MongoDB not having auth active per default. But both applications were consciously chosen by Newsblur.
Or this, for that matter
---
So that you have it, my original ask was: But what's the end user a victim of in this case? Other than a brief lack of availability?
> It's not all that great blaming the victim.
Which is what I was replying to.
Of course this incident was inconsequential for Newsblur's customers. That in this case the impact for the customers was approx. zero doesn't change the relationship of Mongo+Docker <> Newsblur <> customers (i.e. who has responsibility and who feels the consequences, which defines who can be a victim), just the outcome for the customers.
See my previous note:
> There can be multiple victims, multiple causes/threat actors, and overlap between two categories.
I think we've both concluded now that newsblur was largely a victim as a consumer of docker.
Cheers, glad this helped.
Software culture is IMHO problematic there in multiple dimensions.