[SillentTroll]

- Why should it be disabled by default? I don't agree it should, but understand why it is disabled by default: for easy and quick start of development on the local machine.

[dx034]

Isn't it as fast if you bind it to a local user by default? You can still change it afterwards, but that way there's no set up for developers.

[SillentTroll]

Yes, it is the same.

In my case the database already had some users configured. But because I did't start the server with --auth option, MongoDB ignored all users and allowed everyone to connect.