Reply to thread

Message: <blockquote data-quote="jameson_uk" data-source="post: 972354" data-attributes="member: 11220">Well reasoned argument <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite11" alt=":rolleyes:" title="Roll Eyes    :rolleyes:" loading="lazy" data-shortname=":rolleyes:" /> First off lets be clear that root access was a bad decision a long time ago and have never been updated. MP does not need (and should not be using) root access to the database. Lets put this in context though.... Your analogy to house keys is pretty poor, it is more akin to locking your fridge, leaving the keys on the table in front room inside a locked house and not tellilng anyone that the keys are lying around <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite12" alt="o_O" title="Er... what?    o_O" loading="lazy" data-shortname="o_O" /> . I would imaging that something like 99.9% of users have a MySQL database purely for MP. They do not understand databases and it was just installed when MP was and they have never touched it since. So MP has free access to MP data, in this use case there is little difference to running as a limited user. The database is going to be on an internal network, no-one is going to be invited in... The remaining 0.1% of users are already maintaining a database so should be able to setup a second instance or add a new user (or decide that MP is not for them) Security is about risk. You have connected your computer on the internet and visited a website thus exposing your machine to risk. You took that decision that the risk was worth it and probably have some mitigation in place (NAT firewall, AV software...). Just tried this and it and it has only taken a few minutes to check this works (or at least appears to).Installed MySQL then as root:[code]create user 'MP'@'HOST' identified by 'MP';create database MPTVDB;grant all on MPTVDB.* to 'MP'@'HOST';grant select on mysql.* 'MP'@'HOST';[/code]Install MP (choose advanced installation and existing SQL database)You will be prompted for details as aboveNot entirely sure why the SELECT is needed on mysql database but this is far better than root access to all databases.    So MP running against a MySQL database without connecting as a root user. Just to re-iterate though this is not ideal and should be changed. I am not advocating the access as a good thing but it is no where near as bad as you are making out. As you feel so strongly about this there are a few options:<ul> <li data-xf-list-type="ul">Do nothing. Stop trolling here and don't look at this again.</li> <li data-xf-list-type="ul">Setup a user as above and have MP access your MySQL instance not as root</li> <li data-xf-list-type="ul">Help out. Develop the necessary changes to remove the use of root and supply the details as a patch / git pull request</li> </ul>Which of these do you feel fits best with Open Source software? <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite8" alt=":D" title="Big Grin    :D" loading="lazy" data-shortname=":D" /></blockquote>

Verification