Thread

1. continuational · 1786022679 · focus · HN ↗

   It's kinda funny there is still software coming out whose security model is "constantly ask the user for permission, and hope they never make a mistake".

   It's been tried so many times before, and it never worked.

   1. brunoborges · 1786027372 · focus · HN ↗

      I joined Oracle in 2012, and I myself complained that the user experience was horrible: get an Oracle DB installed was a nightmare, starting with so many questions. I heard complaints from other users about it requiring, during installation, that an admin password must be set.

      I myself had preferred to use MySQL because it was so simple and easy to get started and using it.

      Until I learned how many MySQL databases were configured without user/password and many instances were reachable over the internet.

      Then, eventually products started to move towards "don't even ask the user to set a password, otherwise they will set a stupid password" and just generate the password during installation. This made the user think more before saving that password or changing the password to something less stupid. But better than all that, liability was no longer with the software maker.

      1. com2kid · 1786035426 · focus · HN ↗

         I got bit by this with redis a couple years ago. The default install on my VPS's distro had it open to the world by default, and it even configured UFW for me (gee thanks!)

         No password, owned within seconds of install. :/

Unofficial Hacker News client; not affiliated with Y Combinator.