We've been hacked
pen.blahaj.zone
So we have some bad news. Some news I had hoped we’d never have to tell you. Unfortunately the blahaj zone instances have been hacked. ...

Blahaj.zone experienced a security breach and is handling it to properly reduce the risk of harm to their users. the current eta for their reture is in about 7 hours.

  • WhyJiffie@sh.itjust.worksEnglish
    3·
    14 hours ago

    Use a separate DBMS (that is, a separate postgres/mariasql/etc container) for each service. Give each one service unique passwords, which you can define in the docker compose.

    unique passwords is good practice, but separate db server for each of the services is extreme. it brings much more resource consumption. the solution here is being subscribed to security releases and updating soon. those application kernels also sound like a good idea. and as I understand, postgres permissions were not at fault, the permission system had a bug.

    Even if one application that connects to a database gets owned, it doesn’t have access to other postgres databases, preventing data leaks/exfiltration.

    except that because of the bug, anyone with query permission could have become postgres superuser.

    • moonpiedumplings@programming.devEnglish
      2·
      7 hours ago

      except that because of the bug, anyone with query permission could have become postgres superuser.

      If a user can’t log in to a DBMS, they don’t have query permission.

      separate db server for each of the services is extreme. it brings much more resource consumption.

      Yes. It consumes more resources. But it’s not that much more, and you can make it fit easily. Many users using docker compose unwittingly do this since docker composes often bring their own database containers. When done consciously, you make a trade off for peace of mind.

      the solution here is being subscribed to security releases and updating soon.

      I addressed takes like these in the last part of my previous comment. The linked comment also elaborates on my opinions about manual updates, manually watching security releases, and other forms of security toil.