The MongoDB hack and the importance of secure defaults
When our sysadmin set up our Mongo cluster, he firewalled out all IPs except our production systems, turned on authentication, set things up to ensure we used SSL, and configured backups.<p>He didn&#x27;t do this because he&#x27;s an amazing sysadmin. He did it because he&#x27;s competent, knows how to put a service on the Internet, and RTFM.<p>I mean. If you can connect to something and use it without having to authenticate yourself, wouldn&#x27;t it naturally cross your mind to check that others can&#x27;t do the same? It&#x27;s just common sense.