On: Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage

[beermonster]

I think by default mongodb has no enabled access control, so there is no default user or password.

[vultour → beermonster]

Am I misunderstanding or do people launch their Mongo container without even MONGO_INITDB_ROOT_{USERNAME,PASSWORD}? It's clearly mentioned in the image README. Takes 15 seconds to set. I'd be incredibly concerned if anybody with more than a day of infrastructure experience did this, even worse on a production database.

[pm90 → beermonster]

How is this acceptable… requiring a password, even a weak one might have at least bought some time in this situation.

[beermonster → pm90]

See https://acowebs.com/mongodb-security/