[angry_octet]

You mean, like uncontrolled keys that can be used from anywhere and have no lifecycle care? Well at least SSH keys can't be guessed.

Redis suffers from security gatekeeping, where essential features are kept in the paid Enterprise fork, and community security efforts are blocked. So you can use x.509 mutual TLS certificate auth, but the setup is entirely manual. Which means you use long lived certificates, which is worse than hard passwords.

It needs short lived certificates and pinning against endpoints, and logging of endpoints against queries, and logging auth events/origins to the SIEM. If you have that setup then post-auth compromise is more manageable.

[inigyou]

Here's a thought: if you want something to exist, create it instead of begging a for-profit company to let you use their work for free.

[angry_octet]

Maybe for-profit companies shouldn't be gatekeeping core security features in open source products, and should instead deliver value in terms of debugging and performance, that are highly valued by enterprise customers.