16 ms·

Tesla.com/.gitignore

457 points by nateb2022 4y ago

athesyn 4y ago
It's just their landing page, but still embarrassing nonetheless.
antman 4y ago
I think this site's code repository needs to be reviewed. Maybe should call some twitter engineers
- deleted 4y ago
  [deleted]
KevinBenSmith 4y ago
Can’t access it…
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- jjgreen 4y ago
  # Ignore configuration files that may contain sensitive information. sites/*/settings*.php # Ignore paths that contain user-generated content. sites/*/files sites/*/private
  - deleted 4y ago
    [deleted]
  - codetrotter 4y ago
    Archived copy for reference https://archive.ph/C6qJ4 https://archive.ph/C6qJ4
dergachev 4y ago
Drupal
- snapetom 4y ago
  There was a posting just this week on a job site for a "Sr. Software Engineer, Backend Drupal" at Tesla. Putting together pieces like a leaked .gitignore file, job postings, etc. is social engineering in action.
  - deleted 4y ago
    [deleted]
  - viraptor 4y ago
    That's not social engineering. You're not convincing anyone to do anything or share anything with you. This is OSINT.
- deleted 4y ago
  [deleted]
- arcturus17 4y ago
  Does this not come as a surprise to anyone? I'd have figured that they would have rolled out their own custom headless CMS or something really complex. I mean, not that it doesn't make sense for them to use a bog-standard CMS tool, but my biases (halo effect?) would have made me think that they use something more more unique.
  - rabuse 4y ago
    Why over-engineer something that just doesn't bring much value to their company?
  - ElijahLynn 4y ago
    Drupal is pretty powerful and there is a large talent pool for it, so it can probably handle all their CMS needs just fine. And that would be smart not to roll their own.
formerly_proven 4y ago
[flagged]
- jstx1 4y ago
  Maybe the other way around - his ignore file has "Tesla" in it?
anonym29 4y ago
If you think .gitignore leaks too much info, you're going to love https://www.tesla.com/robots.txt https://www.tesla.com/robots.txt
- soneil 4y ago
  The start/stop at the bottom makes that look like it's come canned with a CMS and they've just tacked on what they needed to. It's 90% boilerplate.
  - chx 4y ago
    It's hardly a secret tesla.com is Drupal -- both that gitignore and the robots.txt shouts it quite loudly, to be fair. One of the larger Drupal agencies, Lullabot includes them in their clients list: https://www.lullabot.com/our-work https://www.lullabot.com/our-work and they are looking for a sr backend Drupal engineer https://www.tesla.com/careers/search/job/sr-software-engineer-backend-drupal-137554 https://www.tesla.com/careers/search/job/sr-software-enginee... which I would take if the company were not lead by Musk.
    - ughitsaaron 4y ago
      More to that point, see https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt
      - stefan_ 4y ago
        Is this a normal Drupal practice? You just deploy the Git repo?
        extheat 4y ago
        Do you deploy confidential information into the repo ? That would be the root problem.
        4y ago
1attice 4y ago
- jerkstate 4y ago
  if only someone would offer to take it private for 3x its value!
  - sylware 4y ago
    you forgot 1 figure: 30x
    - sylware 4y ago
      actually... maybe 2 figures: 300x
  - eastbound 4y ago
    I wonder whether he’s just taking revenge upon the employees for mocking him buying it for 3x its revenue. “SEC wants me to buy it whole because I have 9%? Employees and board are happy to force my hand? Ok.” Being suicidal and ready to lose everything to make a point, is probably another facet of the same character trait.
  - ignoramous 4y ago
    Time for a TeslaDAO. The cryptonomics are in the favour of us plebs, and I reckon we'd meme up a100z billions in no time.
- deleted 4y ago
  [deleted]
- edgyquant 4y ago
  This is not Reddit, please don’t treat it as such
  - DoctorOW 4y ago
    I think it's okay to criticize a company on Hacker News even if the leadership is particularly popular here.
djegod 4y ago
Ask myself what other files will be exposed?
jbverschoor 4y ago
So basically you run an endless script to fetch https://www.tesla.com/sites/default/settings.php https://www.tesla.com/sites/default/settings.php and hope that some day there will be a minor nginx config error which lets you download the php source instead of executing it. This will happen some day, so invest 5 bucks per month to exploit Tesla at a certain point, so maybe you can be first in line for the Cybertruck :-)
- rvnx 4y ago
  This seems to be a too sophisticated attack, sometimes simplicity is better: https://samcurry.net/cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program/ https://samcurry.net/cracking-my-windshield-and-earning-1000...
  - j-bos 4y ago
    Great read
  - walrus01 4y ago
    Time to try naming your tesla "drop table vehicles;"
    - gdhdjdvr 4y ago
      Ah good old bobby tables :)
      - shaheer_dev 4y ago
        l
  - deleted 4y ago
    [deleted]
  - grubby 4y ago
    this was such a great read, people like you make me want to learn more and more everyday
behnamoh 4y ago
Can someone explain why this is leaky and how it can be exploited by malicious actors?
- bobthepanda 4y ago
  The gitignore explicitly called out where the sensitive settings file is, so presumably that makes it a lot easier to figure out where to start injecting bad code
  - Alupis 4y ago
    Sure, but this appears like some very standard directories for popular website CMS platforms like Drupal. So, not very surprising and probably doesn't really tip anyone towards anything particularly special.
- m00x 4y ago
  It's probably caused by an incorrect nginx configuration, which means other static files may be exposed. Otherwise, it's not much of a leak.
- rvnx 4y ago
  This shows that the teams in charge of code deployment have relatively weak quality control. In practice, it means that if the gitignore file is leaked, that there is a substantial risk that they accidentally leak the .git folder someday. The .git folder indirectly contains downloadable copies of the source-code of the website, which could very likely lead to credentials leak or compromised services. Your life can depend on Tesla.com services. Even if you are the pedestrian side.
  - bpodgursky 4y ago
    I'd be pretty surprised if the marketing / landing site was remotely connected to the user portal. Most companies have a marketing-friendly CMS for public content, disconnected from the actual customer-facing portal.
sschueller 4y ago
At least https://www.tesla.com/.git/config https://www.tesla.com/.git/config is not accessible but still. This should never happen to a company that considers itself a software company first and a car company second.
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- tomjakubowski 4y ago
  One place I worked for exposed .git on a PHP site to the world. Infra was ho-hum about the report until they got a PoC which cloned the repo.
newbieuser 4y ago
universal galactic extreme programming requires it
nr2x 4y ago
Good thing these are the people who helped fire Twitter's security team. Sure that's going to work out great.
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
revskill 4y ago
So, should we just add .gitignore to .gitignore and problem solved ?
- alvis 4y ago
  No. You never checkout a site directly from git to begin with. You don't let other people know what files are ignored from git doesn't mean people cannot access them. :/
  - teknopaul 4y ago
    Nonsense. Everyone uses git for source control, of course you check out a site with git. All you are telling people with a .gitingore is what is _not_ available. It means exactly that people can not access them if your site is a checkout, because they aren't there.
    - NateEag 4y ago
      Many of us have a build process that converts the contents of a checkout into a deployable site (a.k.a. "build artifact"). The build process can trivially skip .gitignore files (and all other files that are strictly for dev environments). You then deploy the build artifact to production, with exactly the set of files which ought to be there.
      - noselasd 4y ago
        There's cases where you don't need a build process for a site.
        NateEag 4y ago
        Sure. In those cases a build process is usually trivially easy to put together, and has benefits, so while not necessary it's still beneficial.
        4y ago
alvis 4y ago
There is a `cron.php` lol
- MH15 4y ago
  behind auth as of 4pm ET though
kalium-xyz 4y ago
My dear American friends. What if this is a psyop from tesla marketing to get your attention?
- paulryanrogers 4y ago
  Very well could be a honeypot. Though neglect and accretion is more likely
- noncoml 4y ago
  “Never attribute to malice that which can be adequately explained by stupidity”
  - Cyphase 4y ago
    "Always design your malice to be adequately explainable as stupidity."
- dopeboy 4y ago
  Along with the acquisition of Twitter.
- deleted 4y ago
  [deleted]
alvis 4y ago
One of the best technology companies (let's assume it's) cannot maintain its site with modern technology. How can I trust them?
- hutzlibu 4y ago
  I do not trust Tesla because of the apparent instability of its owner, but not because its website does not use the most bleeding edge web technology. The website works and I see no information of any security flaws. This is what matters.
  - anecdotal1 4y ago
    Does Elon personally drive every Tesla? Or do you think Tesla engineers will follow an insane directive knowing it would put peoples lives at risk and not push back or straight up walk off the job?
    - d23 4y ago
      > Or do you think Tesla engineers will follow an insane directive knowing it would put peoples lives at risk and not push back or straight up walk off the job? By this logic, it's actually impossible for a company to ever do anything wrong.
    - Aeolun 4y ago
      > do you think Tesla engineers will follow an insane directive knowing it would put peoples lives at risk and not push back Have you seen what remains of Twitters engineers? All of them are fanboys that think Musk can do no wrong. Of course they’d do whatever the man says. I have to imagine the same is true for Tesla.
- rbanffy 4y ago
  They build cars and batteries, not websites.
  - jahsome 4y ago
jongjong 4y ago
outside1234 4y ago
“Hardcore Engineering”
- x86x87 4y ago
  all the engineers that have not modified at least 50 lines in the .gitignore file in the last 60 days have been not terminated
- rsynnott 4y ago
  I mean, in fairness, if you're not getting enough rest (which seems to be what "hardcore engineering" means) then maybe you're more likely to screw up the nginx config.
- mlindner 4y ago
  A web page isn't "hardcore engineering".
ackatz 4y ago
Getting 403 Forbidden now
bri3d 4y ago
Not to defend the Twitter situation, which is foolhardy by almost any measure, but it's extremely uncommon for any company's main landing page to relate in any way to their software engineering team. Usually these marketing sites are running a CMS (this one looks like Drupal) which is owned and operated by either an internal team who report to the CIO / IT department (vs the Product/Engineering group) or a totally external third-party marketing firm. As long as the "real" product uses different subdomains, certificates, proper HSTS, cross-origin protection, and secure cookies (a tall order, yes, but something that would be an issue no matter what the marketing site is doing), security issues in the "marketing" site aren't as bad. Of course a marketing site takeover is still worrying, as it's a prime entry point for spearphishing and horizontal movement through social engineering, but these usually aren't the same engineers or security team at all.
- cmeacham98 4y ago
  Nobody (sane) is saying this is a security vulnerability or the like (especially as it seems to be a default Drupal gitignore). It's just a funny mistake from a "software first" company.
  - mlindner 4y ago
    There's several people in the comments saying exactly that kind of thing in this thread including people asking if it leads to vehicle code exploits.
    - cmeacham98 4y ago
      I never claimed everybody on HN was sane /shrug
  - shudza 4y ago
    So what is gonna be your opinion when it gets fixed?
    - cmeacham98 4y ago
tomjakubowski 4y ago
Interesting, the exclude file (actually, everything under .git/info) 403s, while .git/index is a 404. - https://www.tesla.com/.git/info/exclude https://www.tesla.com/.git/info/exclude - https://www.tesla.com/.git/index https://www.tesla.com/.git/index README.txt 403s too. https://www.tesla.com/README.txt https://www.tesla.com/README.txt edit: just going to add files I've found here: - https://www.tesla.com/.editorconfig https://www.tesla.com/.editorconfig - https://www.tesla.com/profiles/README.txt https://www.tesla.com/profiles/README.txt
- retrocryptid 4y ago
  sigh
  - retrocryptid 4y ago
    really? five down-votes because I sighed? If you're going to down-vote me, down-vote me because I mentioned Elon is a human being, with human flaws and human strengths and not the resurrection of Supply-Side-Jesus.
- TechTechTech 4y ago
  https://cdn-design.tesla.com/.git/ https://cdn-design.tesla.com/.git/ this url says 'No.'
- jahsome 4y ago
  Add a trailing slash to index and it 403s
- bumblewax 4y ago
  Two space tabs, nice.
- Merlin04 4y ago
  There's also https://www.tesla.com/phpunit.xml https://www.tesla.com/phpunit.xml
v0idzer0 4y ago
It’s not leaky at all.
soheil 4y ago
> sites//settings.php Yes PHP is still relevant!
- dpcan 4y ago
  Yeah. WordPress, Drupal, Joomla, Laravel, vanilla php. Together they power almost 45-50% of the web. So PHP is still extremely relevant. The most relevant you might be able to say.
  - soheil 4y ago
    I just don't understand why Apache dropped native php module support forcing everyone to deal with finicky cgi.
akomtu 4y ago
mlindner 4y ago
I think a lot of people in here are overreacting a bit. This is an interesting curiosity that doesn't really have any baring on any of Tesla's internal software.
- deleted 4y ago
  [deleted]
datalopers 4y ago
They've got something a bit more fucked up than just an exposed .gitignore $ curl -si https://www.tesla.com/ | grep generator x-generator: Drupal 9 (https://www.drupal.org) $ curl -si https://www.tesla.com/authorize.php | grep generator x-generator: Drupal 7 (http://drupal.org) So they have at least two versions running at the same time. The /authorize.php [1] uri also yields a 500 (instead of a 403 like most of the other resources), which implies Apache is most likely passing the request off to PHP and the script has a fatal or unhandled error. The webroot appears to be a Drupal 7.x installation and Apache is serving that content directly (e.g. https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt same as [2]) and trying to run some of it (authorize.php), while happy-path requests are being reverse-proxied to a Drupal 9.x installation. [1] https://github.com/drupal/drupal/blob/7.x/authorize.php https://github.com/drupal/drupal/blob/7.x/authorize.php [2] https://github.com/drupal/drupal/blob/7.x/MAINTAINERS.txt https://github.com/drupal/drupal/blob/7.x/MAINTAINERS.txt
- ec109685 4y ago
  They likely have layer 7 load balancing sending different paths to different servers.
  - diamondo25 4y ago
    Guess Elon should go and reduce some Tesla services like he did with Twitter. Having different major versions of software running must take up a lot of maintenance...
    - koonsolo 4y ago
      Maybe he should bring in some Twitter developers to review the code at Tesla.
      - keyle 4y ago
        I usually don't engage in silly comments but this made me belly laugh loud, ta.
ashirviskas 4y ago
So Tesla is free software: https://www.tesla.com/LICENSE.txt https://www.tesla.com/LICENSE.txt
- deleted 4y ago
  [deleted]
- gl-prod 4y ago
  Drupal is.
- sceadu 4y ago
  Maybe that means they won't pull the same shenanigans that Mercedes did :)
elleven 4y ago
https://www.tesla.com/LICENSE.txt https://www.tesla.com/LICENSE.txt Tesla opensource confirmed?
- deleted 4y ago
  [deleted]
dingosity 4y ago
The reason people think this is bad form is it indicates the site operators did something they did not need to do. It is an artifact of carelessness at best or misunderstanding of how their web server software works at worst. You do not need to serve a .gitignore file for a site to perform its basic function. But the obverse is also true. Serving .gitignore does not detract from the function of the site. But among people who do this kind of thing for a living, there's a belief that every action you take (like copy a .gitignore file to the directory from which static files are served) should have an intent which can be traced to a specific requirement. It's crazy to believe some product manager sat down and put "serve up a .gitignore file" in their PRD. Some people are therefore taking the existence of the .gitignore file in Tesla's public webspace to demonstrate a lack of care when it comes to matching requirements with behaviour. But as people have pointed out, maybe this isn't a Tesla failing as much as it is a failing for one of their providers. And sure, on the list of failures, this is pretty minor. And if you can find a web host that ties behaviour to explicit requirements, I would LOVE to hear about it. Web hosting is a low margin business which doesn't pay premiums for detail oriented staff. To be sure, there are some AMAZING people working for web hosting outfits, but my point is they are working at web hosting firms in spite of their technical capabilities, not because of them. To say Tesla is a crap-fest because they left a .gitignore in their public web-space is laughable. Tesla is a crap-fest because their stock is in the toilet, they often blow past promised delivery dates (cybertruck, anyone?) and are extracting cash from the rubes who believe "full self driving" means your car will drive itself in more than the most contrived of contexts. Elon Musk is not an idiot because you can read a .gitignore from tesla.com. Having done business w/ Mr. Musk, I can assure you he is not an idiot. But he's also did not impress me as the super-genius many seem to make him out to be. He is not playing 4D chess. He's a reasonably intelligent guy who won the lottery (rich parents, older brother who cut him in for a percentage, met the right people just as the USG wanted to buy more launch capability and state and federal governments subsidizing electric cars.) If anything, he's uncanny in his ability to identify opportunity. Maybe that's even better than the Sili Valley execs whose skills extend to being white, pretty and GSB educated. (If you downvote me, please downvote me for the slight on the Haas School this last comment was intended to be.) To recap... serving a .gitignore in your public web-space doesn't mean you're a dolt. It also means you're probably taking less care than you could. But maybe we don't need to take such care on a static web-site. But it does make me wistful for the days when competence was more obviously exhibited. Elon Musk is considered a jerk because of his behaviour, not because someone in one of his companies left tesla.com/.gitignore in the public web-space. Tesla is not god's gift to American industry. It is a bit of a goose up the backside of entrenched incumbents, and for that I will always have a soft spot for it. Except for the bits where they seem to be a lightning rod for controversy which always seem to be unforced errors. Good Day To You, Sir!
fnordpiglet 4y ago
It’s ok. Elon code reviewed it.
- kobalsky 4y ago
  this isn't reddit
  - SV_BubbleTime 4y ago
    And it isn’t clever there. Elon makes a bunch of moves and posts that all revolve around pruning the company. And it’s become “omg he wants code printed, he’s so stoopid!”. If I was going to prune a company, I would do the exact same thing to immediately weed out the people that came (figuratively) empty handed. They know they’re done and it would save me the time.
    - scaramanga 4y ago
      Yeah, some people just think parasites and sociopaths should be at the bottom of our society, not at the top... Perfectly valid viewpoint, it just happens to be the opposite of yours.
  - Traubenfuchs 4y ago
    It's rapidly becoming like it though. I don't know why, but the quality of comments is decreasing and more and more zero (see the comment you responded to) / negative value comments appear. The decline has become noticeable in the last ~half year.
  - deleted 4y ago
    [deleted]
- deleted 4y ago
  [deleted]
Hormold 4y ago
Check this: https://cdn-design.tesla.com/tds-fonts/ https://cdn-design.tesla.com/tds-fonts/ Saved version: TypeError: Cannot read property '0' of null at forceFontAssetSource (/app/routes/middleware/moduleVersion.js:89:32) at Layer.handle [as handle_request] (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/layer.js:95:5) at trim_prefix (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:317:13) at /app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:284:7 at Function.process_params (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:335:12) at next (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:275:10) at cors (/app/node_modules/cors/lib/index.js:188:7) at /app/node_modules/cors/lib/index.js:224:17 at originCallback (/app/node_modules/cors/lib/index.js:214:15) at /app/node_modules/cors/lib/index.js:219:13
- deleted 4y ago
  [deleted]
sassy_quat 4y ago
Hilariously most people are unable to program in a secure fashion. https://www.zdnet.com/article/over-100000-github-repos-have-leaked-api-or-cryptographic-keys/ https://www.zdnet.com/article/over-100000-github-repos-have-... News about Tesla's security seems vaguely wanting, I do not know what this .gitignore file is about, but it is quite alarming enough to draw conclusions from.
- sassy_quat 4y ago
  Edit: failed to provide context, most people should be left out of writing public interfaces for non-hard real time systems.
hankchinaski 4y ago
I like the simplicity and pragmatism of using drupal. I wouldn’t work with it myself but it was probably the cheapest/fastest way to get a similar site up and running
- rbanffy 4y ago
  Indeed. I'd use Plone, but it's overkill for a website like this.
- throwaway6734 4y ago
  If you stick completely within the Drupal"standard path", it's a great way to get a site up and running. Once you step outside of that path it's an absolute misery
  - jpoesen 4y ago
    Dunking on a tech while using a throwaway account and not providing details on why you find it absolute misery... not very useful or trustworthy.
    - throwaway6734 4y ago
      I spent around 3 years working with Drupal 7 and and about a half a year with Drupal 8. For D7: * The frontend and backend are too tightly coupled. * The views system was awful to design custom, complex queries for. Documentation was scarce * No dependency management * Lots of weird hacks to do standard things, like the Features module * The hooks system can result in a lot of complex, unclear logic I've since moved onto the python/js ecosystem and it's much easier to build sites in
      - jpoesen 4y ago
        Thanks. Too bad you didn't find Drupal worth hanging around for. Great you found a stack that makes you happier.
RobertWHurst 4y ago
You all are cringe. Anyone working in tech knows that most marketing sites are made by third parties, likely some WordPress shop. The hatred for Elon on this site is ridiculous.
- misiti3780 4y ago
  it's very weird. someone responded once that hacker news is a bunch of smart dorks that are basically jealous because they have not achieved anywhere near as much as elon has. i think there is some truth to this.
  - rbanffy 4y ago
    How many of us were born owning an emerald mine after all?
    - misiti3780 4y ago
      seriously ? go drink a Guinness.
      - rbanffy 4y ago
        I'm more of a Red Breast kind of person.
        misiti3780 4y ago
        also a great choice!
    - mlindner 4y ago
      Maybe do some basic fact checking? Thank you for affirming the stereotype. https://www.snopes.com/news/2022/11/17/elon-musk-emerald-mine/ https://www.snopes.com/news/2022/11/17/elon-musk-emerald-min... > Here's a summary of our findings: We located reporting from as far back as 2009 and 2014 that said when Elon Musk ("Elon" herefafter) was a child in South Africa in the 1980s, his father ("Errol" hereafter) at some point owned "a stake in an emerald mine" near Lake Tanganyika in Zambia, not South Africa. Beyond that, we were unable to find any evidence that showed money generated from his father's involvement in the mine helped Elon build his wealth in North America. I'll add that it's also well known that while Elon's father was certainly well off compared to the average population in South Africa, they were not fabulously rich. They were also anti-apartheid. His father's personal income was primarily from being an engineer, not a mine owner.
jamesy0ung 4y ago
Getting a 403 Forbidden error.
ericmcer 4y ago
A companies marketing website and their actual products have little in common. I would be surprised if any engineers even work on the marketing website and blown away if it is co-located with something sensitive.
- FormerBandmate 4y ago
  https://xkcd.com/932/ https://xkcd.com/932/ Ffs, a tech forum should be better than this
  - wink 4y ago
    No, it's a valid complaint - I've seen it at several companies that the development team were eager to present a professional website (so that anyone in the know looking would not find such embarrassing stuff and maybe scare off potential new hires or customers) but it ended up in the hands of the marketing department. To the degree that the infra was moved to a different domain so the wordpress install at "www.example.com" could never even remotely do anything with cookies at "example.net" - but yes, that might have been a tad paranoid ;) I think the person you were replying to was not playing down the thing that happened, but explained exactly what the cartoon said. It not being important for the general public does mean it's not a probable fact.
    - FormerBandmate 4y ago
      I was agreeing with the person I replied to. Most of the rest of the thread is implying this affects self-driving somehow
- ranman 4y ago
  I would judge a vendor or consulting firm based on their marketing website. Why wouldn't I judge a car maker?
camel-cdr 4y ago
It looks like https://www.tesla.com/INSTALL.txt https://www.tesla.com/INSTALL.txt & https://www.tesla.com/README.txt https://www.tesla.com/README.txt exist, but aren't accessible.
camel-cdr 4y ago
https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt
SV_BubbleTime 4y ago
The Venn diagram of people who had an issue with the Tesla website yesterday, and people laughing at it being Drupal today does not intersect.
adolph 4y ago
Potentially also of interest is robots.txt. Who knew Tesla had ontologists? https://www.tesla.com/robots.txt https://www.tesla.com/robots.txt Disallow: /taxonomy/term/* 404: https://www.tesla.com/taxonomy/term/ https://www.tesla.com/taxonomy/term/
unixhero 4y ago
Huh... php
lxe 4y ago
Some Tesla holiday on-call devops or security person is probably getting paged over this right now.
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
madmod 4y ago
I found a bug in the tesla model 3 reservation system that allowed anyone to get a reservation for free. Reported it via hackerone (or maybe it was bugcrowd dont remember) and got told it was of no consequence and would be filtered out later or something. Got no bounty for hours of work. I accidentally ordered my model 3 with a free reservation, not the one I actually paid for.
- jonathanyc 4y ago
  Given that people are selling reservations for thousands of dollars, I think you deserved something for reporting the issue. But I suppose being a hardcore engineer means never having to say you're sorry.
KETpXDDzR 4y ago
Archived version: https://web.archive.org/web/20221126004310/https://www.tesla.com/.gitignore https://web.archive.org/web/20221126004310/https://www.tesla...
za3faran 4y ago
Seems they took it offline. Any mirrors?

457 points by nateb2022 4y ago

athesyn 4y ago

It's just their landing page, but still embarrassing nonetheless.

antman 4y ago

I think this site's code repository needs to be reviewed. Maybe should call some twitter engineers

deleted 4y ago
[deleted]

KevinBenSmith 4y ago

Can’t access it…

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
jjgreen 4y ago
# Ignore configuration files that may contain sensitive information. sites/*/settings*.php # Ignore paths that contain user-generated content. sites/*/files sites/*/private
- deleted 4y ago
  [deleted]
- codetrotter 4y ago
  Archived copy for reference https://archive.ph/C6qJ4 https://archive.ph/C6qJ4

dergachev 4y ago

Drupal

snapetom 4y ago
There was a posting just this week on a job site for a "Sr. Software Engineer, Backend Drupal" at Tesla. Putting together pieces like a leaked .gitignore file, job postings, etc. is social engineering in action.
- deleted 4y ago
  [deleted]
- viraptor 4y ago
  That's not social engineering. You're not convincing anyone to do anything or share anything with you. This is OSINT.
deleted 4y ago
[deleted]
arcturus17 4y ago
Does this not come as a surprise to anyone? I'd have figured that they would have rolled out their own custom headless CMS or something really complex. I mean, not that it doesn't make sense for them to use a bog-standard CMS tool, but my biases (halo effect?) would have made me think that they use something more more unique.
- rabuse 4y ago
  Why over-engineer something that just doesn't bring much value to their company?
- ElijahLynn 4y ago
  Drupal is pretty powerful and there is a large talent pool for it, so it can probably handle all their CMS needs just fine. And that would be smart not to roll their own.

formerly_proven 4y ago

[flagged]

jstx1 4y ago
Maybe the other way around - his ignore file has "Tesla" in it?

anonym29 4y ago

If you think .gitignore leaks too much info, you're going to love https://www.tesla.com/robots.txt https://www.tesla.com/robots.txt

soneil 4y ago
The start/stop at the bottom makes that look like it's come canned with a CMS and they've just tacked on what they needed to. It's 90% boilerplate.
- chx 4y ago
  It's hardly a secret tesla.com is Drupal -- both that gitignore and the robots.txt shouts it quite loudly, to be fair. One of the larger Drupal agencies, Lullabot includes them in their clients list: https://www.lullabot.com/our-work https://www.lullabot.com/our-work and they are looking for a sr backend Drupal engineer https://www.tesla.com/careers/search/job/sr-software-engineer-backend-drupal-137554 https://www.tesla.com/careers/search/job/sr-software-enginee... which I would take if the company were not lead by Musk.
  - ughitsaaron 4y ago
    More to that point, see https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt
    - stefan_ 4y ago
      Is this a normal Drupal practice? You just deploy the Git repo?
      - extheat 4y ago
        Do you deploy confidential information into the repo ? That would be the root problem.
        4y ago

1attice 4y ago

jerkstate 4y ago
if only someone would offer to take it private for 3x its value!
- sylware 4y ago
  you forgot 1 figure: 30x
  - sylware 4y ago
    actually... maybe 2 figures: 300x
- eastbound 4y ago
  I wonder whether he’s just taking revenge upon the employees for mocking him buying it for 3x its revenue. “SEC wants me to buy it whole because I have 9%? Employees and board are happy to force my hand? Ok.” Being suicidal and ready to lose everything to make a point, is probably another facet of the same character trait.
- ignoramous 4y ago
  Time for a TeslaDAO. The cryptonomics are in the favour of us plebs, and I reckon we'd meme up a100z billions in no time.
deleted 4y ago
[deleted]
edgyquant 4y ago
This is not Reddit, please don’t treat it as such
- DoctorOW 4y ago
  I think it's okay to criticize a company on Hacker News even if the leadership is particularly popular here.

djegod 4y ago

Ask myself what other files will be exposed?

jbverschoor 4y ago

So basically you run an endless script to fetch https://www.tesla.com/sites/default/settings.php https://www.tesla.com/sites/default/settings.php and hope that some day there will be a minor nginx config error which lets you download the php source instead of executing it. This will happen some day, so invest 5 bucks per month to exploit Tesla at a certain point, so maybe you can be first in line for the Cybertruck :-)

rvnx 4y ago
This seems to be a too sophisticated attack, sometimes simplicity is better: https://samcurry.net/cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program/ https://samcurry.net/cracking-my-windshield-and-earning-1000...
- j-bos 4y ago
  Great read
- walrus01 4y ago
  Time to try naming your tesla "drop table vehicles;"
  - gdhdjdvr 4y ago
    Ah good old bobby tables :)
    - shaheer_dev 4y ago
      l
- deleted 4y ago
  [deleted]
- grubby 4y ago
  this was such a great read, people like you make me want to learn more and more everyday

behnamoh 4y ago

Can someone explain why this is leaky and how it can be exploited by malicious actors?

bobthepanda 4y ago
The gitignore explicitly called out where the sensitive settings file is, so presumably that makes it a lot easier to figure out where to start injecting bad code
- Alupis 4y ago
  Sure, but this appears like some very standard directories for popular website CMS platforms like Drupal. So, not very surprising and probably doesn't really tip anyone towards anything particularly special.
m00x 4y ago
It's probably caused by an incorrect nginx configuration, which means other static files may be exposed. Otherwise, it's not much of a leak.
rvnx 4y ago
This shows that the teams in charge of code deployment have relatively weak quality control. In practice, it means that if the gitignore file is leaked, that there is a substantial risk that they accidentally leak the .git folder someday. The .git folder indirectly contains downloadable copies of the source-code of the website, which could very likely lead to credentials leak or compromised services. Your life can depend on Tesla.com services. Even if you are the pedestrian side.
- bpodgursky 4y ago
  I'd be pretty surprised if the marketing / landing site was remotely connected to the user portal. Most companies have a marketing-friendly CMS for public content, disconnected from the actual customer-facing portal.

sschueller 4y ago

At least https://www.tesla.com/.git/config https://www.tesla.com/.git/config is not accessible but still. This should never happen to a company that considers itself a software company first and a car company second.

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
tomjakubowski 4y ago
One place I worked for exposed .git on a PHP site to the world. Infra was ho-hum about the report until they got a PoC which cloned the repo.

newbieuser 4y ago

universal galactic extreme programming requires it

nr2x 4y ago

Good thing these are the people who helped fire Twitter's security team. Sure that's going to work out great.

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]

revskill 4y ago

So, should we just add .gitignore to .gitignore and problem solved ?

alvis 4y ago
No. You never checkout a site directly from git to begin with. You don't let other people know what files are ignored from git doesn't mean people cannot access them. :/
- teknopaul 4y ago
  Nonsense. Everyone uses git for source control, of course you check out a site with git. All you are telling people with a .gitingore is what is _not_ available. It means exactly that people can not access them if your site is a checkout, because they aren't there.
  - NateEag 4y ago
    Many of us have a build process that converts the contents of a checkout into a deployable site (a.k.a. "build artifact"). The build process can trivially skip .gitignore files (and all other files that are strictly for dev environments). You then deploy the build artifact to production, with exactly the set of files which ought to be there.
    - noselasd 4y ago
      There's cases where you don't need a build process for a site.
      - NateEag 4y ago
        Sure. In those cases a build process is usually trivially easy to put together, and has benefits, so while not necessary it's still beneficial.
        4y ago

alvis 4y ago

There is a `cron.php` lol

MH15 4y ago
behind auth as of 4pm ET though

kalium-xyz 4y ago

My dear American friends. What if this is a psyop from tesla marketing to get your attention?

paulryanrogers 4y ago
Very well could be a honeypot. Though neglect and accretion is more likely
noncoml 4y ago
“Never attribute to malice that which can be adequately explained by stupidity”
- Cyphase 4y ago
  "Always design your malice to be adequately explainable as stupidity."
dopeboy 4y ago
Along with the acquisition of Twitter.
deleted 4y ago
[deleted]

alvis 4y ago

One of the best technology companies (let's assume it's) cannot maintain its site with modern technology. How can I trust them?

hutzlibu 4y ago
I do not trust Tesla because of the apparent instability of its owner, but not because its website does not use the most bleeding edge web technology. The website works and I see no information of any security flaws. This is what matters.
- anecdotal1 4y ago
  Does Elon personally drive every Tesla? Or do you think Tesla engineers will follow an insane directive knowing it would put peoples lives at risk and not push back or straight up walk off the job?
  - d23 4y ago
    > Or do you think Tesla engineers will follow an insane directive knowing it would put peoples lives at risk and not push back or straight up walk off the job? By this logic, it's actually impossible for a company to ever do anything wrong.
  - Aeolun 4y ago
    > do you think Tesla engineers will follow an insane directive knowing it would put peoples lives at risk and not push back Have you seen what remains of Twitters engineers? All of them are fanboys that think Musk can do no wrong. Of course they’d do whatever the man says. I have to imagine the same is true for Tesla.
rbanffy 4y ago
They build cars and batteries, not websites.
- jahsome 4y ago

jongjong 4y ago

outside1234 4y ago

“Hardcore Engineering”

x86x87 4y ago
all the engineers that have not modified at least 50 lines in the .gitignore file in the last 60 days have been not terminated
rsynnott 4y ago
I mean, in fairness, if you're not getting enough rest (which seems to be what "hardcore engineering" means) then maybe you're more likely to screw up the nginx config.
mlindner 4y ago
A web page isn't "hardcore engineering".

ackatz 4y ago

Getting 403 Forbidden now

bri3d 4y ago

Not to defend the Twitter situation, which is foolhardy by almost any measure, but it's extremely uncommon for any company's main landing page to relate in any way to their software engineering team. Usually these marketing sites are running a CMS (this one looks like Drupal) which is owned and operated by either an internal team who report to the CIO / IT department (vs the Product/Engineering group) or a totally external third-party marketing firm. As long as the "real" product uses different subdomains, certificates, proper HSTS, cross-origin protection, and secure cookies (a tall order, yes, but something that would be an issue no matter what the marketing site is doing), security issues in the "marketing" site aren't as bad. Of course a marketing site takeover is still worrying, as it's a prime entry point for spearphishing and horizontal movement through social engineering, but these usually aren't the same engineers or security team at all.

cmeacham98 4y ago
Nobody (sane) is saying this is a security vulnerability or the like (especially as it seems to be a default Drupal gitignore). It's just a funny mistake from a "software first" company.
- mlindner 4y ago
  There's several people in the comments saying exactly that kind of thing in this thread including people asking if it leads to vehicle code exploits.
  - cmeacham98 4y ago
    I never claimed everybody on HN was sane /shrug
- shudza 4y ago
  So what is gonna be your opinion when it gets fixed?
  - cmeacham98 4y ago

tomjakubowski 4y ago

Interesting, the exclude file (actually, everything under .git/info) 403s, while .git/index is a 404. - https://www.tesla.com/.git/info/exclude https://www.tesla.com/.git/info/exclude - https://www.tesla.com/.git/index https://www.tesla.com/.git/index README.txt 403s too. https://www.tesla.com/README.txt https://www.tesla.com/README.txt edit: just going to add files I've found here: - https://www.tesla.com/.editorconfig https://www.tesla.com/.editorconfig - https://www.tesla.com/profiles/README.txt https://www.tesla.com/profiles/README.txt

retrocryptid 4y ago
sigh
- retrocryptid 4y ago
  really? five down-votes because I sighed? If you're going to down-vote me, down-vote me because I mentioned Elon is a human being, with human flaws and human strengths and not the resurrection of Supply-Side-Jesus.
TechTechTech 4y ago
https://cdn-design.tesla.com/.git/ https://cdn-design.tesla.com/.git/ this url says 'No.'
jahsome 4y ago
Add a trailing slash to index and it 403s
bumblewax 4y ago
Two space tabs, nice.
Merlin04 4y ago
There's also https://www.tesla.com/phpunit.xml https://www.tesla.com/phpunit.xml

v0idzer0 4y ago

It’s not leaky at all.

soheil 4y ago

> sites//settings.php Yes PHP is still relevant!

dpcan 4y ago
Yeah. WordPress, Drupal, Joomla, Laravel, vanilla php. Together they power almost 45-50% of the web. So PHP is still extremely relevant. The most relevant you might be able to say.
- soheil 4y ago
  I just don't understand why Apache dropped native php module support forcing everyone to deal with finicky cgi.

akomtu 4y ago

mlindner 4y ago

I think a lot of people in here are overreacting a bit. This is an interesting curiosity that doesn't really have any baring on any of Tesla's internal software.

deleted 4y ago
[deleted]

datalopers 4y ago

They've got something a bit more fucked up than just an exposed .gitignore $ curl -si https://www.tesla.com/ | grep generator x-generator: Drupal 9 (https://www.drupal.org) $ curl -si https://www.tesla.com/authorize.php | grep generator x-generator: Drupal 7 (http://drupal.org) So they have at least two versions running at the same time. The /authorize.php [1] uri also yields a 500 (instead of a 403 like most of the other resources), which implies Apache is most likely passing the request off to PHP and the script has a fatal or unhandled error. The webroot appears to be a Drupal 7.x installation and Apache is serving that content directly (e.g. https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt same as [2]) and trying to run some of it (authorize.php), while happy-path requests are being reverse-proxied to a Drupal 9.x installation. [1] https://github.com/drupal/drupal/blob/7.x/authorize.php https://github.com/drupal/drupal/blob/7.x/authorize.php [2] https://github.com/drupal/drupal/blob/7.x/MAINTAINERS.txt https://github.com/drupal/drupal/blob/7.x/MAINTAINERS.txt

ec109685 4y ago
They likely have layer 7 load balancing sending different paths to different servers.
- diamondo25 4y ago
  Guess Elon should go and reduce some Tesla services like he did with Twitter. Having different major versions of software running must take up a lot of maintenance...
  - koonsolo 4y ago
    Maybe he should bring in some Twitter developers to review the code at Tesla.
    - keyle 4y ago
      I usually don't engage in silly comments but this made me belly laugh loud, ta.

ashirviskas 4y ago

So Tesla is free software: https://www.tesla.com/LICENSE.txt https://www.tesla.com/LICENSE.txt

deleted 4y ago
[deleted]
gl-prod 4y ago
Drupal is.
sceadu 4y ago
Maybe that means they won't pull the same shenanigans that Mercedes did :)

elleven 4y ago

https://www.tesla.com/LICENSE.txt https://www.tesla.com/LICENSE.txt Tesla opensource confirmed?

deleted 4y ago
[deleted]

dingosity 4y ago

The reason people think this is bad form is it indicates the site operators did something they did not need to do. It is an artifact of carelessness at best or misunderstanding of how their web server software works at worst. You do not need to serve a .gitignore file for a site to perform its basic function. But the obverse is also true. Serving .gitignore does not detract from the function of the site. But among people who do this kind of thing for a living, there's a belief that every action you take (like copy a .gitignore file to the directory from which static files are served) should have an intent which can be traced to a specific requirement. It's crazy to believe some product manager sat down and put "serve up a .gitignore file" in their PRD. Some people are therefore taking the existence of the .gitignore file in Tesla's public webspace to demonstrate a lack of care when it comes to matching requirements with behaviour. But as people have pointed out, maybe this isn't a Tesla failing as much as it is a failing for one of their providers. And sure, on the list of failures, this is pretty minor. And if you can find a web host that ties behaviour to explicit requirements, I would LOVE to hear about it. Web hosting is a low margin business which doesn't pay premiums for detail oriented staff. To be sure, there are some AMAZING people working for web hosting outfits, but my point is they are working at web hosting firms in spite of their technical capabilities, not because of them. To say Tesla is a crap-fest because they left a .gitignore in their public web-space is laughable. Tesla is a crap-fest because their stock is in the toilet, they often blow past promised delivery dates (cybertruck, anyone?) and are extracting cash from the rubes who believe "full self driving" means your car will drive itself in more than the most contrived of contexts. Elon Musk is not an idiot because you can read a .gitignore from tesla.com. Having done business w/ Mr. Musk, I can assure you he is not an idiot. But he's also did not impress me as the super-genius many seem to make him out to be. He is not playing 4D chess. He's a reasonably intelligent guy who won the lottery (rich parents, older brother who cut him in for a percentage, met the right people just as the USG wanted to buy more launch capability and state and federal governments subsidizing electric cars.) If anything, he's uncanny in his ability to identify opportunity. Maybe that's even better than the Sili Valley execs whose skills extend to being white, pretty and GSB educated. (If you downvote me, please downvote me for the slight on the Haas School this last comment was intended to be.) To recap... serving a .gitignore in your public web-space doesn't mean you're a dolt. It also means you're probably taking less care than you could. But maybe we don't need to take such care on a static web-site. But it does make me wistful for the days when competence was more obviously exhibited. Elon Musk is considered a jerk because of his behaviour, not because someone in one of his companies left tesla.com/.gitignore in the public web-space. Tesla is not god's gift to American industry. It is a bit of a goose up the backside of entrenched incumbents, and for that I will always have a soft spot for it. Except for the bits where they seem to be a lightning rod for controversy which always seem to be unforced errors. Good Day To You, Sir!

fnordpiglet 4y ago

It’s ok. Elon code reviewed it.

kobalsky 4y ago
this isn't reddit
- SV_BubbleTime 4y ago
  And it isn’t clever there. Elon makes a bunch of moves and posts that all revolve around pruning the company. And it’s become “omg he wants code printed, he’s so stoopid!”. If I was going to prune a company, I would do the exact same thing to immediately weed out the people that came (figuratively) empty handed. They know they’re done and it would save me the time.
  - scaramanga 4y ago
    Yeah, some people just think parasites and sociopaths should be at the bottom of our society, not at the top... Perfectly valid viewpoint, it just happens to be the opposite of yours.
- Traubenfuchs 4y ago
  It's rapidly becoming like it though. I don't know why, but the quality of comments is decreasing and more and more zero (see the comment you responded to) / negative value comments appear. The decline has become noticeable in the last ~half year.
- deleted 4y ago
  [deleted]
deleted 4y ago
[deleted]

Hormold 4y ago

Check this: https://cdn-design.tesla.com/tds-fonts/ https://cdn-design.tesla.com/tds-fonts/ Saved version: TypeError: Cannot read property '0' of null at forceFontAssetSource (/app/routes/middleware/moduleVersion.js:89:32) at Layer.handle [as handle_request] (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/layer.js:95:5) at trim_prefix (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:317:13) at /app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:284:7 at Function.process_params (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:335:12) at next (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:275:10) at cors (/app/node_modules/cors/lib/index.js:188:7) at /app/node_modules/cors/lib/index.js:224:17 at originCallback (/app/node_modules/cors/lib/index.js:214:15) at /app/node_modules/cors/lib/index.js:219:13

deleted 4y ago
[deleted]

sassy_quat 4y ago

Hilariously most people are unable to program in a secure fashion. https://www.zdnet.com/article/over-100000-github-repos-have-leaked-api-or-cryptographic-keys/ https://www.zdnet.com/article/over-100000-github-repos-have-... News about Tesla's security seems vaguely wanting, I do not know what this .gitignore file is about, but it is quite alarming enough to draw conclusions from.

sassy_quat 4y ago
Edit: failed to provide context, most people should be left out of writing public interfaces for non-hard real time systems.

hankchinaski 4y ago

I like the simplicity and pragmatism of using drupal. I wouldn’t work with it myself but it was probably the cheapest/fastest way to get a similar site up and running

rbanffy 4y ago
Indeed. I'd use Plone, but it's overkill for a website like this.
throwaway6734 4y ago
If you stick completely within the Drupal"standard path", it's a great way to get a site up and running. Once you step outside of that path it's an absolute misery
- jpoesen 4y ago
  Dunking on a tech while using a throwaway account and not providing details on why you find it absolute misery... not very useful or trustworthy.
  - throwaway6734 4y ago
    I spent around 3 years working with Drupal 7 and and about a half a year with Drupal 8. For D7: * The frontend and backend are too tightly coupled. * The views system was awful to design custom, complex queries for. Documentation was scarce * No dependency management * Lots of weird hacks to do standard things, like the Features module * The hooks system can result in a lot of complex, unclear logic I've since moved onto the python/js ecosystem and it's much easier to build sites in
    - jpoesen 4y ago
      Thanks. Too bad you didn't find Drupal worth hanging around for. Great you found a stack that makes you happier.

RobertWHurst 4y ago

You all are cringe. Anyone working in tech knows that most marketing sites are made by third parties, likely some WordPress shop. The hatred for Elon on this site is ridiculous.

misiti3780 4y ago
it's very weird. someone responded once that hacker news is a bunch of smart dorks that are basically jealous because they have not achieved anywhere near as much as elon has. i think there is some truth to this.
- rbanffy 4y ago
  How many of us were born owning an emerald mine after all?
  - misiti3780 4y ago
    seriously ? go drink a Guinness.
    - rbanffy 4y ago
      I'm more of a Red Breast kind of person.
      - misiti3780 4y ago
        also a great choice!
  - mlindner 4y ago
    Maybe do some basic fact checking? Thank you for affirming the stereotype. https://www.snopes.com/news/2022/11/17/elon-musk-emerald-mine/ https://www.snopes.com/news/2022/11/17/elon-musk-emerald-min... > Here's a summary of our findings: We located reporting from as far back as 2009 and 2014 that said when Elon Musk ("Elon" herefafter) was a child in South Africa in the 1980s, his father ("Errol" hereafter) at some point owned "a stake in an emerald mine" near Lake Tanganyika in Zambia, not South Africa. Beyond that, we were unable to find any evidence that showed money generated from his father's involvement in the mine helped Elon build his wealth in North America. I'll add that it's also well known that while Elon's father was certainly well off compared to the average population in South Africa, they were not fabulously rich. They were also anti-apartheid. His father's personal income was primarily from being an engineer, not a mine owner.

jamesy0ung 4y ago

Getting a 403 Forbidden error.

ericmcer 4y ago

A companies marketing website and their actual products have little in common. I would be surprised if any engineers even work on the marketing website and blown away if it is co-located with something sensitive.

FormerBandmate 4y ago
https://xkcd.com/932/ https://xkcd.com/932/ Ffs, a tech forum should be better than this
- wink 4y ago
  No, it's a valid complaint - I've seen it at several companies that the development team were eager to present a professional website (so that anyone in the know looking would not find such embarrassing stuff and maybe scare off potential new hires or customers) but it ended up in the hands of the marketing department. To the degree that the infra was moved to a different domain so the wordpress install at "www.example.com" could never even remotely do anything with cookies at "example.net" - but yes, that might have been a tad paranoid ;) I think the person you were replying to was not playing down the thing that happened, but explained exactly what the cartoon said. It not being important for the general public does mean it's not a probable fact.
  - FormerBandmate 4y ago
    I was agreeing with the person I replied to. Most of the rest of the thread is implying this affects self-driving somehow
ranman 4y ago
I would judge a vendor or consulting firm based on their marketing website. Why wouldn't I judge a car maker?

camel-cdr 4y ago

It looks like https://www.tesla.com/INSTALL.txt https://www.tesla.com/INSTALL.txt & https://www.tesla.com/README.txt https://www.tesla.com/README.txt exist, but aren't accessible.

camel-cdr 4y ago

https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt

SV_BubbleTime 4y ago

The Venn diagram of people who had an issue with the Tesla website yesterday, and people laughing at it being Drupal today does not intersect.

adolph 4y ago

Potentially also of interest is robots.txt. Who knew Tesla had ontologists? https://www.tesla.com/robots.txt https://www.tesla.com/robots.txt Disallow: /taxonomy/term/* 404: https://www.tesla.com/taxonomy/term/ https://www.tesla.com/taxonomy/term/

unixhero 4y ago

Huh... php

lxe 4y ago

Some Tesla holiday on-call devops or security person is probably getting paged over this right now.

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

madmod 4y ago

I found a bug in the tesla model 3 reservation system that allowed anyone to get a reservation for free. Reported it via hackerone (or maybe it was bugcrowd dont remember) and got told it was of no consequence and would be filtered out later or something. Got no bounty for hours of work. I accidentally ordered my model 3 with a free reservation, not the one I actually paid for.

jonathanyc 4y ago
Given that people are selling reservations for thousands of dollars, I think you deserved something for reporting the issue. But I suppose being a hardcore engineer means never having to say you're sorry.

KETpXDDzR 4y ago

Archived version: https://web.archive.org/web/20221126004310/https://www.tesla.com/.gitignore https://web.archive.org/web/20221126004310/https://www.tesla...

za3faran 4y ago

Seems they took it offline. Any mirrors?