Thread

1. continuational · 1786022679 · focus · HN ↗

   It's kinda funny there is still software coming out whose security model is "constantly ask the user for permission, and hope they never make a mistake".

   It's been tried so many times before, and it never worked.

   1. brunoborges · 1786027372 · focus · HN ↗

      I joined Oracle in 2012, and I myself complained that the user experience was horrible: get an Oracle DB installed was a nightmare, starting with so many questions. I heard complaints from other users about it requiring, during installation, that an admin password must be set.

      I myself had preferred to use MySQL because it was so simple and easy to get started and using it.

      Until I learned how many MySQL databases were configured without user/password and many instances were reachable over the internet.

      Then, eventually products started to move towards "don't even ask the user to set a password, otherwise they will set a stupid password" and just generate the password during installation. This made the user think more before saving that password or changing the password to something less stupid. But better than all that, liability was no longer with the software maker.

      1. dwedge · 1786031188 · focus · HN ↗

         Maybe it's distro specific but I'm fairly sure mysql by default installed with skip networking around 2012, and with bind-address set to localhost since then. Also the root user is only configured from local by default but I'm not sure if that was true 14 years ago.

         If the defaults are more secure than your examples, it's not fair to blame the database or the defaults.

         And personally I hate it when software forces security requirements on me. Maybe I don't need an admin password. It's one reason I gave up on selfhosted gitlab - there was no option to reduce password complexity for my users, and those users were only connecting from the local network. The other reason being that it spammed 100GB of logs in a month and was using 11GB of RAM before I'd even gotten around to setting up the first repo.

         1. dylan604 · 1786033476 · focus · HN ↗

            Most software matures to the point that sane defaults get set. In the early days, one could be forgiven for making MVP as the security and attack vectors were still growing. Now that attacks have matured, and new software that is released without mitigation of these mature risks is just dumb and lazy and deserve no forgiveness for being released that way.

Unofficial Hacker News client; not affiliated with Y Combinator.