[HN Gopher] MongoBleed Explained Simply
       ___________________________________________________________________
        
       MongoBleed Explained Simply
        
       Author : todsacerdoti
       Score  : 39 points
       Date   : 2025-12-28 21:03 UTC (1 hours ago)
        
 (HTM) web link (bigdata.2minutestreaming.com)
 (TXT) w3m dump (bigdata.2minutestreaming.com)
        
       | maxrmk wrote:
       | How often are mongo instances exposed to the internet? I'm more
       | of an SQL person and for those I know it's pretty uncommon, but
       | does happen.
        
         | wood_spirit wrote:
         | The article links to a shodan scan reporting 213K exposed
         | instances
         | https://www.shodan.io/search?query=Product%3A%22MongoDB%22
        
         | hahahacorn wrote:
         | A highly cited reason for using mongo is that people would
         | rather not figure out a schema. (N=3/3 for "serious" orgs I
         | know using mongo).
         | 
         | That sort of inclination to push off doing the right thing now
         | to save yourself a headache down the line probably overlaps
         | with "let's just make the db publicly exposed" instead of doing
         | the work of setting up an internal network to save yourself a
         | headache down the line.
        
           | TZubiri wrote:
           | I would have hoped that there would be no important data in
           | mongoDB.
           | 
           | But now we can at least be rest assured that the important
           | data in mongoDB is just very hard to read with the lack of
           | schemas.
           | 
           | Probably all of that nasty "schema" work and tech debt will
           | finally be done by hackers trying to make use of that
           | information.
        
         | petcat wrote:
         | From my experience, Mongo DB's entire raison d'etre is
         | "laziness".
         | 
         | * Don't worry about a schema.
         | 
         | * Don't worry about persistence or durability.
         | 
         | * Don't worry about reads or writes.
         | 
         | * Don't worry about connectivity.
         | 
         | This is basically the entire philosophy, so it's not surprising
         | at all that users would also not worry about basic security.
        
       | whynotmaybe wrote:
       | I'm still thinking about the hypothetical optimism brought by
       | OWASP top 10 hoping that major flaws will be solved and that
       | buffer overflow has been there since the beginning... in 2003.
        
       ___________________________________________________________________
       (page generated 2025-12-28 23:00 UTC)