4 ms·

> Bad people can use tools to download/restore the repository to gain access to your website’s sourcecode. So if I post my website's sourcecode on github, I'm

> Bad people can use tools to download/restore the repository to gain access to your website’s sourcecode. So if I post my website's sourcecode on github, I'm equally vulnerable? I could see problems if said checkout contained a credential cache, but that doesn't seem to be mentioned.

floatingatoll 9y ago
Yes. It's not necessarily a problem, but it's a risk to consider carefully at licensing time.
azag0 9y ago
This is the old security via obscurity. At least though, one should know that one publishes the full source.
Izmaki 9y ago
If you post your source code to github you know it will be public, and might remember to remove passwords from debug code etc., however if you expect it to be private, while it's not, you might be lazy and store passwords in plaintext in the code. A horrible thought for a programmer, yes, but human beings are lazy.
_wmd 9y ago
git clone https://username:password@github.com/.. https://username:password@github.com/... will end up in git reflog, so yes, it's a problem, and there's no guarantee a future feature of Git that you've never heard of doesn't make the problem worse
- falsedan 9y ago
  reflog is local though
  - _wmd 9y ago
    http://your.broken.site/.git/logs/HEAD http://your.broken.site/.git/logs/HEAD
    - falsedan 9y ago
      I don't understand. Do you mean, the remote also has a reflog? It sure does, it's local to the repository! But entries recorded in my reflog are not pushed to or fetched from any remote I interact with. Instead, their reflog is updated when I push (to record that my commits were accepted & their branches/tags changed), and my reflog is updated when I fetch (to record that their commits were accepted & my branches/tags changed).
      - _wmd 9y ago
        And what happens when Ansible checks out the Git repository for you? Or some equivalent shell script or deployment system, or some helpful developer hand-deploying something with 'git clone' on the server? Or what about helpful developer that checked in some secrets which are visible in the repository history but not the current checkout? Or that stupid PHP thing where 'config.php' and its MySQL passwords are world-readable, but rely on the web server interpreting it as a PHP script due to its file extension to prevent secret leaks.. not so valid when a copy of the script if available as ".git/objects/00/cf74f2066b0c72a4c4b2a24ef116f1fd23df42". But of course, even if these weren't problems, the original point still stands: there is no guarantee .git doesn't contain secret data (such as username:password) either now, or into the future, so exposing it is a bad idea. https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege
        falsedan 9y ago
        That's too much commentary for me to extract from a single fake link to an NXDOMAIN. > there is no guarantee .git doesn't contain secret data (such as username:password) either now, or into the future, so exposing it is a bad idea. The same can be said of the HTML and images, so I don't find it a useful heuristic. Note that I was disputing your claim that a username+password used to fetch a repo over http would leak into the remote's reflog.
- jldugger 9y ago
  > git clone https://username:password@github.com/.. https://username:password@github.com/... will end up in git reflog So if your deploy process is an anonymous git checkout of Drupal, there's no credential leaking to worry about. > no guarantee a future feature of Git that you've never heard of doesn't make the problem worse Okay.

floatingatoll 9y ago

Yes. It's not necessarily a problem, but it's a risk to consider carefully at licensing time.

azag0 9y ago

This is the old security via obscurity. At least though, one should know that one publishes the full source.

Izmaki 9y ago

If you post your source code to github you know it will be public, and might remember to remove passwords from debug code etc., however if you expect it to be private, while it's not, you might be lazy and store passwords in plaintext in the code. A horrible thought for a programmer, yes, but human beings are lazy.

_wmd 9y ago

git clone https://username:password@github.com/.. https://username:password@github.com/... will end up in git reflog, so yes, it's a problem, and there's no guarantee a future feature of Git that you've never heard of doesn't make the problem worse

falsedan 9y ago
reflog is local though
- _wmd 9y ago
  http://your.broken.site/.git/logs/HEAD http://your.broken.site/.git/logs/HEAD
  - falsedan 9y ago
    I don't understand. Do you mean, the remote also has a reflog? It sure does, it's local to the repository! But entries recorded in my reflog are not pushed to or fetched from any remote I interact with. Instead, their reflog is updated when I push (to record that my commits were accepted & their branches/tags changed), and my reflog is updated when I fetch (to record that their commits were accepted & my branches/tags changed).
    - _wmd 9y ago
      And what happens when Ansible checks out the Git repository for you? Or some equivalent shell script or deployment system, or some helpful developer hand-deploying something with 'git clone' on the server? Or what about helpful developer that checked in some secrets which are visible in the repository history but not the current checkout? Or that stupid PHP thing where 'config.php' and its MySQL passwords are world-readable, but rely on the web server interpreting it as a PHP script due to its file extension to prevent secret leaks.. not so valid when a copy of the script if available as ".git/objects/00/cf74f2066b0c72a4c4b2a24ef116f1fd23df42". But of course, even if these weren't problems, the original point still stands: there is no guarantee .git doesn't contain secret data (such as username:password) either now, or into the future, so exposing it is a bad idea. https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege
      - falsedan 9y ago
        That's too much commentary for me to extract from a single fake link to an NXDOMAIN. > there is no guarantee .git doesn't contain secret data (such as username:password) either now, or into the future, so exposing it is a bad idea. The same can be said of the HTML and images, so I don't find it a useful heuristic. Note that I was disputing your claim that a username+password used to fetch a repo over http would leak into the remote's reflog.
jldugger 9y ago
> git clone https://username:password@github.com/.. https://username:password@github.com/... will end up in git reflog So if your deploy process is an anonymous git checkout of Drupal, there's no credential leaking to worry about. > no guarantee a future feature of Git that you've never heard of doesn't make the problem worse Okay.