3 ms·

It would be more like car makers building cars that won’t engage the starter motor if the transmission isn’t in Park, garage door openers reversing if they enco

It would be more like car makers building cars that won’t engage the starter motor if the transmission isn’t in Park, garage door openers reversing if they encounter too much resistance, or lawn mowers that won’t run if you don’t hold down a safety bar. Which is to say, anti-footgun measures are extremely common anywhere foot-shooting is.

jolmg 8y ago
The difference here, and the main point of my analogy is that webservers and git are completely unrelated things like shoes and guns are. That all webservers should guard against misuse with another random piece of software is like having all shoes have protections specifically against a random product that's completely unrelated to shoes. Also, to take the analogy further, the original suggestion was to guard against specific directories .git, .hg, etc. That's like having all shoes protect against only specific models of guns and not others. The point here is that if you want to take this methodology for security, then you'll have to come with an enumeration of all ways the user hurt himself and implement a safety measure for each. That's neither effective nor efficient. Think of all pieces of clothing being required to be bullet-proof, cut-proof, stab-proof, acid-proof, hunger-proof, suffocation-proof, smash-proof, etc. You can't have everything protect the user from everything else via having a safety mechanism for each model-specific thing.
- mikeash 8y ago
  How is that different from my examples where they protect against certain common dangers but don’t even attempt to protect against all the ways you can hurt or kill yourself with them?
  - jolmg 8y ago
    That the safety mechanisms in your examples depend only of knowledge of the object's own mechanisms or generic "other things". For example, your garage door opener reverses when it encounters resistance from anything. It's not that it only reverses when there is one of a specific list of car models that are in its way, and continues to try to close when there is a human in its way or some other type of vehicle or thing. It'll work even if a new type of thing that never existed before gets in its way. It's also different in that it doesn't limit the products functionality when it thinks that you want to make an exception to its primary purpose. A garage door opener is not going to refuse to open when you're trying to come in with a vehicle on fire. A webserver serves files, and inside .git/ are files. You ask it to serve them, then its going to serve them. That you didn't realize you were coming into the garage with a vehicle on fire is no reason for the garage door opener to be required to implement a security mechanism for that very specific thing when there's loads more you could do without realizing.
    - mikeash 8y ago
      I still don’t see the difference. Consider a lawnmower. Its purpose is to cut things. It doesn’t care whether it’s grass or hoses or feet. A common failure mode is to cut the user’s hands or feet. The safety bar helps prevent this. It doesn’t stop you from cutting other people’s hands or feet, and it’s easily bypassed if you want to cut your own, but it’s still a valuable safety feature because this particular accident is so common. Likewise, serving .git is a common problem. Not serving it by default would prevent it. Why is that bad?

jolmg 8y ago

The difference here, and the main point of my analogy is that webservers and git are completely unrelated things like shoes and guns are. That all webservers should guard against misuse with another random piece of software is like having all shoes have protections specifically against a random product that's completely unrelated to shoes. Also, to take the analogy further, the original suggestion was to guard against specific directories .git, .hg, etc. That's like having all shoes protect against only specific models of guns and not others. The point here is that if you want to take this methodology for security, then you'll have to come with an enumeration of all ways the user hurt himself and implement a safety measure for each. That's neither effective nor efficient. Think of all pieces of clothing being required to be bullet-proof, cut-proof, stab-proof, acid-proof, hunger-proof, suffocation-proof, smash-proof, etc. You can't have everything protect the user from everything else via having a safety mechanism for each model-specific thing.

mikeash 8y ago
How is that different from my examples where they protect against certain common dangers but don’t even attempt to protect against all the ways you can hurt or kill yourself with them?
- jolmg 8y ago
  That the safety mechanisms in your examples depend only of knowledge of the object's own mechanisms or generic "other things". For example, your garage door opener reverses when it encounters resistance from anything. It's not that it only reverses when there is one of a specific list of car models that are in its way, and continues to try to close when there is a human in its way or some other type of vehicle or thing. It'll work even if a new type of thing that never existed before gets in its way. It's also different in that it doesn't limit the products functionality when it thinks that you want to make an exception to its primary purpose. A garage door opener is not going to refuse to open when you're trying to come in with a vehicle on fire. A webserver serves files, and inside .git/ are files. You ask it to serve them, then its going to serve them. That you didn't realize you were coming into the garage with a vehicle on fire is no reason for the garage door opener to be required to implement a security mechanism for that very specific thing when there's loads more you could do without realizing.
  - mikeash 8y ago
    I still don’t see the difference. Consider a lawnmower. Its purpose is to cut things. It doesn’t care whether it’s grass or hoses or feet. A common failure mode is to cut the user’s hands or feet. The safety bar helps prevent this. It doesn’t stop you from cutting other people’s hands or feet, and it’s easily bypassed if you want to cut your own, but it’s still a valuable safety feature because this particular accident is so common. Likewise, serving .git is a common problem. Not serving it by default would prevent it. Why is that bad?