We've been hacked
pen.blahaj.zone
So we have some bad news. Some news I had hoped we’d never have to tell you. Unfortunately the blahaj zone instances have been hacked. ...

Blahaj.zone experienced a security breach and is handling it to properly reduce the risk of harm to their users. the current eta for their reture is in about 7 hours.

  • moonpiedumplings@programming.devEnglish
    2·
    7 hours ago

    except that because of the bug, anyone with query permission could have become postgres superuser.

    If a user can’t log in to a DBMS, they don’t have query permission.

    separate db server for each of the services is extreme. it brings much more resource consumption.

    Yes. It consumes more resources. But it’s not that much more, and you can make it fit easily. Many users using docker compose unwittingly do this since docker composes often bring their own database containers. When done consciously, you make a trade off for peace of mind.

    the solution here is being subscribed to security releases and updating soon.

    I addressed takes like these in the last part of my previous comment. The linked comment also elaborates on my opinions about manual updates, manually watching security releases, and other forms of security toil.