Perhaps you should assume people who are using it like this carefully weighted security against their requirements and came to the conclusion that it's a legit tradeoff.
> This is just broken by design software development.
> Perhaps you should assume people who are using it like this carefully weighted security against their requirements and came to the conclusion that it's a legit tradeoff.
Perhaps. Or perhaps "well, I'll just use Redis because everyone else uses Redis." This is, in my experience, common. Most people choosing a stack aren't qualified to evaluate the security approach of their stack.
I don't really have a problem with Redis when somebody's going to actually either do their homework on securing it or are knowingly taking on additional risk. But you have to know it to do it. And vanishingly few people do. (And they don't ask, because they don't know to ask. The five-minute-demo culture has seen to that.)
It's basically impossible to use Redis accidentally in the way you're suggesting - to have absolutely no idea what you're getting into and fail to understand that it can run out of memory and doesn't provide security. Sure maybe before you've ever tried it or read anything at all, but you can't get very far without finding out.
You want Redis to support https so that people who haven't tried it and haven't read anything about it won't accidentally shoot themselves in the foot?
Even if you're right, your argument convinces me it's smarter for Redis to not implement security and say so than to add some in an effort to hide things for people who don't know what they're doing.
Do you have any evidence that the problem you're talking about actually exists wrt Redis? Do you have any evidence that vanishingly few people understand & do homework to offset the body of evidence of the growing number of people that can deal responsibly in security and that things are getting better over time?
> It's basically impossible to use Redis accidentally in the way you're suggesting - to have absolutely no idea what you're getting into and fail to understand that it can run out of memory and doesn't provide security.
It emphatically is not "basically impossible". I've worked with numerous teams where--well, we needed a key/value store, and Redis is cool, so let's use Redis. Hell, we don't even have to read the manual in the hallowed Age of Docker, just pull a container and there we go! Now we have Redis. Did we think about how it worked? Did we think about the security implications? No, because we needed a key/value store and now we have one and we can stop thinking about it now.
(This is why people pay me the medium bucks: to, eventually and usually after getting screwed and potentially harming their users who have no say in the matter, fix their mistakes.)
We have created a culture where ignorance of everything that is not your stack of choice is OK--and your dependencies are somehow not part of that stack, just your programming language and maybe its runtime. This is a bad culture, but it's what we've got and what the Thought Leaders seem to want. It falls to people who do give a shit to build firebreaks to control the damage that can be wrought by the practitioners of the culture of ignorance.
If nothing else, we owe it to the suckers who trust these people to do right by them.
Perhaps you should assume people who are using it like this carefully weighted security against their requirements and came to the conclusion that it's a legit tradeoff.
> This is just broken by design software development.
This is just your "I know it all" mindset.