News for hackers. Stuff that matters.

A comment on Personal and social information of 1.2B people discovered in data leak. Parent comment

Re:Personal and social information of 1.2B people discovered... by Xylakant on Friday November 22, 2019 @02:00PM (#21608772)
> Out of the box it does not even bind to a public internet address.

Bind to all interfaces used to be the default in 1.x - it changed pretty much because people were footgunning themselves.

Coupled with lack of security in the base/free distribution, that made for a dangerous pitfall. At least now security is finally part of the free offering, but the OSS version still comes with no access control at all.

[ Parent | on HN ]
Re:Personal and social information of 1.2B people discovered... by lmilcin on Friday November 22, 2019 @02:51PM (#21609356)
You typically use these in pods which share networking but are not available from outside.

It doesn't matter then if you bind it to 0.0.0.0.

[ Parent | on HN ]
Re:Personal and social information of 1.2B people discovered... by dharmab on Friday November 22, 2019 @02:57PM (#21609414)
At the time it was common to deploy on bare hosts. Deploying ES into a network namespace isn't even the most common use case today.
[ Parent | on HN ]
Re:Personal and social information of 1.2B people discovered... by Xylakant on Saturday November 23, 2019 @03:51AM (#21613161)
That still puts you a single firewall mistake away from disaster. It also places a lot of trust into the applications and hosts that can access ES on a network level: They get full access with no control at all.

To add on that: No security also means no TLS, neither in the cluster communication, no TLS speaking to the client etc.

[ Parent | on HN ]