MongoDB is actively investigating a security incident

Re:MongoDB is actively investigating a security incident by ranting-moth on Saturday December 16, 2023 @04:41PM (#38667984)

Their license "is to require that enhancements to MongoDB be released to the community."

I think it only hurts people who want to freeride the project and extend it for selfish personal gains. That's OK by me.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by PeterZaitsev on Saturday December 16, 2023 @06:40PM (#38668886)

Not really. It really designed to prevent anyone else having MongoDB DBaaS without having license from MongoDB, which it does rather successfully.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by varelaz on Saturday December 16, 2023 @05:13PM (#38668239)

That's reply to Amazon abuse of MongoDB (DocumentDB)

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by PeterZaitsev on Saturday December 16, 2023 @06:42PM (#38668909)

It is the opposite. Amazon would have released MongoDB as a service, same as they do for PostgreSQL or MySQL. As MongoDB changed license they implemented DocumentDB instead.

Note AWS significantly contributes to PostgreSQL and MySQL communities (though you could always want even more) but of course does not to MongoDB. While this is fine for MongoDB Inc I think it is not great for MongoDB community at large

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by peterfarkas on Saturday December 16, 2023 @10:50PM (#38670180)

Anyone can provide Postgres, MySQL or other open source databases as a service.

For this reason, there are many providers to choose from, and there is a healthy amount of innovation and competition in the space. Prices are set by market and demand, as it should be.

And then there is MongoDB where only a handful of providers could negotiate a license, and the price is set by MongoDB Inc.

In my opinion this is by no means "fine" from a user perspective as we are talking about database software.

If anyone did freeriding, it is MongoDB Inc. who chose to freeride on the open source community for marketing purposes, before switching to SSPL.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by pleoxy on Saturday December 16, 2023 @05:12PM (#38668236)

Nothing wrong with picking mongo if it's a good fit for your use case.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by cpursley on Saturday December 16, 2023 @07:07PM (#38669071)

And what's a good use case over Postgres jsonb?

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by pleoxy on Saturday December 16, 2023 @07:29PM (#38669206)

When one doesn't want SQL for one.

Nosql is a fun target to beat up on of late. But there are good, even infamous, reasons to avoid SQL. Particular if you want to accomplish flexible record queries from untrusted clients.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by cpursley on Saturday December 16, 2023 @07:45PM (#38669299)

I’ll ask again, what’s a good use case over Postgres jsonb.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by pleoxy on Saturday December 16, 2023 @08:54PM (#38669680)

All you do is poop all over the story about postgres. I'm convinced that no use cases will convince you of anything. I'm not really looking to involve myself in a database holy war.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by cpursley on Sunday December 17, 2023 @05:02AM (#38671746)

Is jsonb in Postgres not flexible enough? I dump external json in there all the time (like large API responses). The jsonb operators work well. And there's an escape hatch that lets you easily convert json to a table. And importantly, you get indexes with Postgres.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by pleoxy on Sunday December 17, 2023 @09:43AM (#38673168)

I apologize for being short with you in my previous response. I need to be better about assuming good faith.

Your response seems to betray a certain ignorance of mongo. Don't you realize that mongo has indexes?

For handling documents, this blog post covers the topic in some depth.

https://jimb-cc.medium.com/postgres-jsonb-meets-mongodb-part...

Might I suggest you actually use mongo on a project before engaging further on the topic. It clearly has had a lot more thought put into it in the context of json documents.

If postgres works great for your use cases, great, go be happy with the tool.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by cpursley on Sunday December 17, 2023 @11:03AM (#38673723)

https://www.dbvis.com/thetable/postgresql-jsonpath/

https://github.com/obartunov/sqljsondoc/blob/master/jsonpath...

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by pleoxy on Sunday December 17, 2023 @04:29PM (#38676644)

Definitely a better solution than the brick wall he hit. Complicated beastie. I can see the appeal if you just love, eat, and breath SQL.

But a query language within a query language feels bolted onto something alien to do something pretty basic. Pass. If I'm teaching this to new engineers, pass also.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by Thaxll on Saturday December 16, 2023 @07:25PM (#38669182)

Postgress is single master which is a huge limitation.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by cpursley on Saturday December 16, 2023 @07:54PM (#38669352)

How so?

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by Thaxll on Saturday December 16, 2023 @08:10PM (#38669453)

How do you scale a single master out of the box?

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by cpursley on Sunday December 17, 2023 @04:57AM (#38671724)

What's nice about Postgres is there's a ton of Postgres compatible products that do scale for the 10% who actually need it. And it's still all just Postgres / SQL.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by Thaxll on Sunday December 17, 2023 @05:49PM (#38677213)

Again it's not out of the box and your so called "tons" vary in quality and features.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by webappguy on Saturday December 16, 2023 @05:24PM (#38668320)

Exactly

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by PeterZaitsev on Saturday December 16, 2023 @06:38PM (#38668867)

Oh yes. By people who do not or does not care about Open Source... and these are many

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by dnndev on Saturday December 16, 2023 @04:29PM (#38667883)

What’s wrong with licensing?

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by sigzero on Saturday December 16, 2023 @04:39PM (#38667970)

https://www.mongodb.com/licensing/server-side-public-license...

I am not sure really.

"It should be noted that the new license maintains all of the same freedoms the community has always had with MongoDB under AGPL - they are free to use, review, modify, and redistribute the source code. The only changes are additional terms that make explicit the conditions for offering a publicly available MongoDB as a service.

Obviously, this new license helps our business, but it is also important for the MongoDB community. MongoDB has invested over $300M in R&D over the past decade to offer an open database for everyone, and with this change, MongoDB will continue to be able to aggressively invest in R&D to drive further innovation and value for the community."

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by mananaysiempre on Saturday December 16, 2023 @05:12PM (#38668231)

MongoDB’s SSPL is neither an open source license[1] nor, most likely, a free software one[2]. Its definition of offering the licensed software as a service is so broad most Linux distributions[3–6] flat out refuse to ship MongoDB (not even in a nonfree repository or the equivalent) so as to (among other things) avoid placing the operators of their package mirrors in legal jeopardy.

[1] https://blog.opensource.org/the-sspl-is-not-an-open-source-l...

[2] https://opensource.stackexchange.com/q/13888

[3] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=915537

[4] https://fedoraproject.org/wiki/Changes/MongoDB_Removal

[5] https://bugzilla.opensuse.org/show_bug.cgi?id=1122267

[6] https://lists.archlinux.org/archives/list/arch-dev-public@li...

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by bdcravens on Saturday December 16, 2023 @04:41PM (#38667979)

https://thenewstack.io/the-case-against-the-server-side-publ...

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by forwardemail on Saturday December 16, 2023 @04:57PM (#38668118)

Encryption at rest is not supported in the community/free version of MongoDB.

We built an email service (IMAP support added a month ago) and wrote a WebSocket to SQLite layer to solve our encryption at rest needs for storage.

See our deep dive at https://forwardemail.net/blog/docs/best-quantum-safe-encrypt... for insight.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by Nextgrid on Saturday December 16, 2023 @05:25PM (#38668323)

I wonder, why would you want DB-managed encryption instead of just putting its storage directory in a LUKS-encrypted volume?

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by forwardemail on Saturday December 16, 2023 @05:38PM (#38668428)

We store each user's individual mailbox as its own encrypted SQLite database file on an encrypted volume. Even if the volume is decrypted, mailboxes can still not be read. This is the main reason and we detail this in the link we shared.

Another requirement was full text search on the mailboxes with the data itself being encrypted at rest (SQLite fit our needs for that too; not many others provide this). We have a comparison chart at https://forwardemail.net/blog/docs/best-quantum-safe-encrypt....

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by dnndev on Saturday December 16, 2023 @05:02PM (#38668151)

Really? How many open source databases do you offer? Some may say it’s not right for randos to complain when you give something away and they complain that it’s missing basics. I just happy someone else wrote most of what I need and I can extend it if needed.

[ Parent | on HN ]

Re:MongoDB is actively investigating a security incident by PeterZaitsev on Saturday December 16, 2023 @08:45PM (#38669640)

Note Percona Server for MongoDB is drop-in replacement for MongoDB and supports Data at Rest Encryption, on SSPL version

https://docs.percona.com/percona-server-for-mongodb/5.0/data...

[ Parent | on HN ]