[petcat]

From my experience, Mongo DB's entire raison d'etre is "laziness".

* Don't worry about a schema.

* Don't worry about persistence or durability.

* Don't worry about reads or writes.

* Don't worry about connectivity.

This is basically the entire philosophy, so it's not surprising at all that users would also not worry about basic security.

[winrid]

Although interestingly, for all the mongo deployments I managed, the first time I saw a cluster publicly exposed without SSL was postgres :)

[senderista]

To the extent that any of this was ever true, it hasn’t been true for at least a decade. After the WiredTiger acquisition they really got their engineering shit together. You can argue it was several years too late but it did happen.

[cyberpunk]

I got heavily burned pre-wiredtiger and swore to never use it again. Started a new job which uses it and it’s been… Painless, stable and fast with excellent support and good libraries. They did turn it around for sure.

[aragilar]

Not only that, but authentication is much harder than it needs to be to set up (and is off by default).

[morshu9001]

I'm sure there are publicly exposed MySQLs too

[zX41ZdbW]

There are many more exposed MySQLs than MongoDBs:

https://www.shodan.io/search?query=mongodb https://www.shodan.io/search?query=mysql https://www.shodan.io/search?query=postgresql

But this must be proportional to the overall popularity.

[Thaxll]

Most of your points are wrong. Maybe only 1- is valid'ish.

[ddtaylor]

Ultimate webscale!