5 ms·

> Apparently because my site didn't return 404, their script assumed i was exposed and they oh so helpfully reported it to me. There's no good reason that fold

> Apparently because my site didn't return 404, their script assumed i was exposed and they oh so helpfully reported it to me. There's no good reason that folder should exist except for a joke, so how is this not a helpful message in the vast majority of cases? All lint rules have exceptions, doesn't make them not useful.

waihtis 6y ago
Well according to the post, the OP returned a cheeky message and any MK I Eyeball should clearly spot it as an intended condition. Automated scan-spam gets on your nerves pretty quickly. I run a small vulnerability disclosure program and receive a ton of it - people clearly run automated scanners, which I presume create automated vulnerability reports, on things that are not even remotely dangerous AND have been specifically ruled out of scope for the program. It's not helpful, it's time consuming and often people will complain if you don't answer their reports.
ryanlol 6y ago
This is not a helpful message in the vast majority of cases. Lots of servers out there that always return 200
- seanwilson 6y ago
  > Lots of servers out there that always return 200 That's poor configuration for most public websites that you want indexed by search bots that's worth fixing. It's called a soft 404, and makes it troublesome to detect when links are invalid, break or have moved. Google will even warn you about it: https://developers.google.com/search/docs/advanced/crawling/soft-404-errors https://developers.google.com/search/docs/advanced/crawling/...
  - ryanlol 6y ago
    The vast majority of servers on port 80 are not public websites that you want indexed by search bots.
arp242 6y ago
I didn't ask you to lint my code (or server) though. There's plenty of cases where a .git directory is just harmless; I've deployed simple static sites by just cloning the repo, and this probably exposed the .git directory. But who cares? There's nothing in there that's secret, and it's just the same as what you would get from the public GitHub repo, so whatever. That some linting tools warns on this: sure, that's reasonable. That random bots start emailing me about this without even the slightest scrutiny because it might expose my super-duper secret proprietary code: that's just spam and rude.
- seanwilson 6y ago
  > That some linting tools warns on this: sure, that's reasonable. To clarify, I'm not condoning annoying spam but if say e.g. Netlify or GitHub added a ".git folder should not exist on a public site" lint rule when you personally deploy your site, I would say it would be a net benefit. > There's plenty of cases where a .git directory is just harmless Pretty much all lint rules have false positives so this isn't a good yardstick. Can it potentially cause harm when you do it and is there's no beneficial reason to do it? If yes to both then it's an ideal candidate for a lint rule.
  - Kalium 6y ago
    > Pretty much all lint rules have false positives so this isn't a good yardstick. Can it potentially cause harm when you do it and is there's no beneficial reason to do it? If yes to both then it's an ideal candidate for a lint rule. A responsible person running such a linter does a sanity check before taking their positive and bugging someone else with it. An irresponsible one potentially causes harm by assuming every single hit is a major finding that should turn into a bounty payout.
    - seanwilson 6y ago
      > A responsible person running such a linter does a sanity check before taking their positive and bugging someone else with it. An irresponsible one potentially causes harm by assuming every single hit is a major finding that should turn into a bounty payout. I already tried to clarify that I was talking about the general concept of good lint rules, not about people emailing for bounty payouts. We're in agreement that emails about bounty payouts for non-issues is stupid.

waihtis 6y ago

Well according to the post, the OP returned a cheeky message and any MK I Eyeball should clearly spot it as an intended condition. Automated scan-spam gets on your nerves pretty quickly. I run a small vulnerability disclosure program and receive a ton of it - people clearly run automated scanners, which I presume create automated vulnerability reports, on things that are not even remotely dangerous AND have been specifically ruled out of scope for the program. It's not helpful, it's time consuming and often people will complain if you don't answer their reports.

ryanlol 6y ago

This is not a helpful message in the vast majority of cases. Lots of servers out there that always return 200

seanwilson 6y ago
> Lots of servers out there that always return 200 That's poor configuration for most public websites that you want indexed by search bots that's worth fixing. It's called a soft 404, and makes it troublesome to detect when links are invalid, break or have moved. Google will even warn you about it: https://developers.google.com/search/docs/advanced/crawling/soft-404-errors https://developers.google.com/search/docs/advanced/crawling/...
- ryanlol 6y ago
  The vast majority of servers on port 80 are not public websites that you want indexed by search bots.

arp242 6y ago

I didn't ask you to lint my code (or server) though. There's plenty of cases where a .git directory is just harmless; I've deployed simple static sites by just cloning the repo, and this probably exposed the .git directory. But who cares? There's nothing in there that's secret, and it's just the same as what you would get from the public GitHub repo, so whatever. That some linting tools warns on this: sure, that's reasonable. That random bots start emailing me about this without even the slightest scrutiny because it might expose my super-duper secret proprietary code: that's just spam and rude.

seanwilson 6y ago
> That some linting tools warns on this: sure, that's reasonable. To clarify, I'm not condoning annoying spam but if say e.g. Netlify or GitHub added a ".git folder should not exist on a public site" lint rule when you personally deploy your site, I would say it would be a net benefit. > There's plenty of cases where a .git directory is just harmless Pretty much all lint rules have false positives so this isn't a good yardstick. Can it potentially cause harm when you do it and is there's no beneficial reason to do it? If yes to both then it's an ideal candidate for a lint rule.
- Kalium 6y ago
  > Pretty much all lint rules have false positives so this isn't a good yardstick. Can it potentially cause harm when you do it and is there's no beneficial reason to do it? If yes to both then it's an ideal candidate for a lint rule. A responsible person running such a linter does a sanity check before taking their positive and bugging someone else with it. An irresponsible one potentially causes harm by assuming every single hit is a major finding that should turn into a bounty payout.
  - seanwilson 6y ago
    > A responsible person running such a linter does a sanity check before taking their positive and bugging someone else with it. An irresponsible one potentially causes harm by assuming every single hit is a major finding that should turn into a bounty payout. I already tried to clarify that I was talking about the general concept of good lint rules, not about people emailing for bounty payouts. We're in agreement that emails about bounty payouts for non-issues is stupid.