Mailing-List: contact marketing-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: marketing@couchdb.apache.org
Received-SPF: error (nike.apache.org: local policy)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\))
Subject: Re: For next NEWS - MongoDB security
From: Lena Reinhard <lena@thehoodiefirm.com>
In-Reply-To: 
 <CAHdjip+dvdU4brA69Nh1-3vPunqCZ7vrAWqDtUzgBYjyM=FKfg@mail.gmail.com>
Date: Mon, 16 Feb 2015 15:09:12 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <480B23FF-4180-492A-80B1-A4C9FA0A831B@thehoodiefirm.com>
References: 
 <CADA9kr-z=wx5RqqVo8nxh1DvgHEqTQqpU5HzzjaBMegHQpUokw@mail.gmail.com>
 <CAHdjipKiG_QD6PjUbYA8WDVWtmSuLdkmNq9r=YCXGMFvzidXjA@mail.gmail.com>
 <CADA9kr9Co+BEHxgdj0rF+X7=uMU+o9zqJMtRZhsvcS6hTEYzPg@mail.gmail.com>
 <A3340BB5-85DA-452F-A886-F10DDA4DDB63@apache.org>
 <CAHdjipKRX+QC8W+aV+Yied1Y0wM=Km7WQBBFcg5zPj+YUPkYAw@mail.gmail.com>
 <FBD43032-7B36-4D78-98DB-BB8E13563B27@apache.org>
 <CAHdjip+dvdU4brA69Nh1-3vPunqCZ7vrAWqDtUzgBYjyM=FKfg@mail.gmail.com>
To: marketing@couchdb.apache.org

Hi folks,

thanks for sending over these links, Andy! To be quite honest, I'm not =
sure what to take out from the discussion that followed in terms of the =
News though. Could one of you help me clarify?

Best,
Lena


> On 12 Feb 2015, at 12:00, Alexander Shorin <kxepal@gmail.com> wrote:
>=20
> On Thu, Feb 12, 2015 at 1:46 PM, Jan Lehnardt <jan@apache.org> wrote:
>>> On 12 Feb 2015, at 11:44, Alexander Shorin <kxepal@gmail.com> wrote:
>>>=20
>>> On Thu, Feb 12, 2015 at 1:36 PM, Jan Lehnardt <jan@apache.org> =
wrote:
>>>>> On 12 Feb 2015, at 09:51, Andy Wenk <andywenk@apache.org> wrote:
>>>>>=20
>>>>> Alex,
>>>>>=20
>>>>> this is the marketing list. It is applicable that if you do not =
configure
>>>>> CouchDB correctly you have security issues. All I want to say here =
is the
>>>>> fact, that not only MongoDB has security leaks when not configured
>>>>> correctly but also CouchDB (and mySQL, and PostgreSQL and ...). So =
it is
>>>>> worth mentioning the findings by these students in the news by =
pointing to
>>>>> their website or paper.
>>>>>=20
>>>>> You are welcome to write an article or blog post about how to =
secure
>>>>> CouchDB and which mechanisms are offered. Maybe also in comparison =
with
>>>>> MongoDB. Would be extremely cool to then point to the article.
>>>>=20
>>>> I remember writing such a thing, but I can=E2=80=99t recall where. =
Anyone remember? :)
>>>=20
>>> This one?
>>> =
http://podefr.tumblr.com/post/30895595277/securing-couchdb-in-3-steps
>>=20
>> Well, that wasn=E2=80=99t written by me, but this will do as a start.
>>=20
>> I want to make sure we communicate that a default CouchDB =
installation *is*
>> secure and that we are thinking hard and long about how to not trick =
people
>> into accidentally exposing their data. Because that=E2=80=99s what we =
do and always
>> have done.
>=20
> Ah, you mean your post...no, I don't even recall such. But even those
> that I posted here needs in additional notes about require_valid_user
> option and https.
>=20
> It's hard to say if "default installation is secure". It doesn't open
> for the world by default, but every one is admin there. Is it secure?
> Technically, no. Could arbitrary evil user hack such installation from
> outside? Technically, again, no, unless user that installed CouchDB
> made additional actions to expose it to the world (reverse proxy) or
> if evil user has access to localhost - with first thing we cannot do
> anything as like as with the second one.
>=20
> --
> ,,,^..^,,,