Re: CVE for hosted services

[Kurt Seifried < kurt@seifried.org >]

Another shining example of failure that could use an identifier:

https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/

https://news.ycombinator.com/item?id=13748028

This is a great example on so many levels. Simple operational/security failure from the sounds of it (default MongoDB setup, so no auth), that would tend to indicate that they also have other problems (if they can't do simple things right...). 

--

Kurt Seifried
kurt@seifried.org