6 ms·
If you think .gitignore leaks too much info, you're going to love https://www.tesla.com/robots.txt https://www.tesla.com/robots.txt
by anonym29 4y ago
If you think .gitignore leaks too much info, you're going to love https://www.tesla.com/robots.txt https://www.tesla.com/robots.txt
- soneil 4y agoThe start/stop at the bottom makes that look like it's come canned with a CMS and they've just tacked on what they needed to. It's 90% boilerplate.
- chx 4y agoIt's hardly a secret tesla.com is Drupal -- both that gitignore and the robots.txt shouts it quite loudly, to be fair. One of the larger Drupal agencies, Lullabot includes them in their clients list: https://www.lullabot.com/our-work https://www.lullabot.com/our-work and they are looking for a sr backend Drupal engineer https://www.tesla.com/careers/search/job/sr-software-engineer-backend-drupal-137554 https://www.tesla.com/careers/search/job/sr-software-enginee... which I would take if the company were not lead by Musk.
- ughitsaaron 4y agoMore to that point, see https://www.tesla.com/MAINTAINERS.txt https://www.tesla.com/MAINTAINERS.txt
- stefan_ 4y agoIs this a normal Drupal practice? You just deploy the Git repo?
- extheat 4y agoDo you deploy confidential information into the repo ? That would be the root problem.
- mynameisvlad 4y agoThings don't have to be confidential to be an issue. Leaking the actual maintainer's names (as opposed to the Drupal list), for instance, would not necessarily be considered confidential, but still an issue if it showed up.
- verbify 4y agoUsually passwords or keys are stored in a config file, and that is stored in a place outside the repo.
- chrismeller 4y agoI think, generally speaking, it’s a PHP standard practice and more broadly a scripting language practice, though it doesn’t really apply to Node. No pre-compiling is required, so you just ship the files. Especially true for anything that offers an Apache module (like mod_php).
- remram 4y agoShip the files sure, ship the top-level folder not really. Most sites will have a "public" subfolder or equivalent, so the READMEs, scripts, sources etc don't get served. Either way, a professional would remove those files or block them at the HTTP server level.
- chrismeller 4y agoEhhh, I don’t know if I agree that most will have anything.
- rbanffy 4y ago> more broadly a scripting language practice, I can tell you it's not the case with Python.
- chrismeller 4y agoInteresting, because that and mod_python were what I was thinking of aside from PHP. What’s the workflow there like?
- rsynnott 4y agoWell, I mean, that might have been somewhat standard practice with mod_python the last time anyone used mod_python, which I would assume was about 15 years ago. Looks like it's been dead since 2010: https://en.wikipedia.org/wiki/Mod_python https://en.wikipedia.org/wiki/Mod_python In practice, I think modern Python webapps usually use WSGI or similar, where you wouldn't be just dumping a bunch of files somewhere.
- ughitsaaron 4y agoYou can compare it to the current version of the same file in the most recent Drupal release https://github.com/drupal/drupal/blob/9.5.x/core/MAINTAINERS.txt https://github.com/drupal/drupal/blob/9.5.x/core/MAINTAINERS...
- chx 4y agoD10 will be out soon :)
- capableweb 4y agoNot to mention a lot of the subsequent requests when loading https://www.tesla.com/ https://www.tesla.com/ contains the HTTP header+value "x-generator: Drupal 9 (https://www.drupal.org https://www.drupal.org)" So yeah, not exactly a secret.
- andirk 4y agoAnd for the lay man: https://builtwith.com/tesla.com https://builtwith.com/tesla.com . Haven't seen Drupal in the wild for years. Good on them!
- capableweb 4y agoProbably you have, lots of websites still using Drupal, heavily customised of course. Search for "websites made with Drupal" and have your jaw dropped, as probably a website or two you visited recently will show up :)
- deleted 4y ago[deleted]
- chx 4y agoThen you aren't visiting too many US government sites , most of the are on Drupal.
- Neil44 4y agoAnd the bumph at the top - crawlers run by Yahoo! and Google - lol
- judge2020 4y agoIt’s the default drupal robots.txt it seems. https://api.drupal.org/api/drupal/robots.txt/5.x https://api.drupal.org/api/drupal/robots.txt/5.x
- m00x 4y agoReally doesn't leak much, and robot.txt is supposed to be accessible from the internet.
- anonym29 4y agoYes, it's meant to be public, but you need not disclose all of what is contained inside of it. I've been on many pentests where paths provided by robots.txt, that I wouldn't have obtained any other way, led to exploitable vulnerabilities. For some reason, a considerable number of people don't seem to think twice about adding sensitive paths to robots.
- teknopaul 4y agoNot the case here tho is it
- anonym29 4y agoWell, we don't really know. Maybe there's some easy-to-guess text file in /misc/ that contains a password for something. We don't know what we don't know. We do know that there's considerably more information exposed here than zero - the question is whether any of that information could lead to sensitive information, not whether or not it constitutes sensitive information by itself.
- slim 4y agothat's defense in depth, right ? /s also sometimes what's in robots.txt becomes invisible to the corporation as well and abviously bugs creep in
- threatripper 4y agoThis looks like a default file from a Drupal installation: https://api.drupal.org/api/drupal/robots.txt/7.x https://api.drupal.org/api/drupal/robots.txt/7.x
- slaymaker1907 4y agoApparently Tesla is FOSS, see https://www.Tesla.com https://www.Tesla.com.
- Ptchd 4y agoWhere can I get the FSD (Fake Self Driving) source code?
- anonym29 4y agoedited to hide my horrific lack of HN text formatting skills
- abdusco 4y agoyou forgot to from autopilot import *
- deleted 4y ago[deleted]
- ChrisClark 4y agoWhat makes it fake? Just today my car drove me from my house to the grocery store with no intervention.
- mynameisvlad 4y agoCool, meanwhile my car feels like it's an unstable toddler whenever FSD has to turn. It feels like if I don't intervene, I'll crash. It's far from "full" self driving.
- Ptchd 4y agoIs that a route that you do often and it happened to have no unpredictable events today?
- jongjong 4y agoIf that's all the dirt that thousands of vengeful fired Twitter ex-employees could find, then Tesla must have excellent security.
- bakugo 4y agoYeah this screams complete and utter desperation. Like, I get that hating Elon is what all the cool kids at school are doing this month but do we really need this immature garbage on the front page of HN all day?
- extheat 4y agoYep, it seems like most of the posters here in this thread don’t do much software engineering from the looks of it. Or are being purposely obtuse here. There is no security vulnerability here in any of the links we’ve seen so far minus some unnecessarily deployed boilerplate. The gitignore file is not the same file your deployment tool uses when publishing a website. If there’s an API endpoint that is public opposed to some static asset, that would be a problem. Nothing we’ve seen here indicates that.
- FormerBandmate 4y agoHonestly, all the Twitter acquisition has shown is how irrelevant to Twitter’s success the management team was. Twitter has gone from a sophisticated, large organization with 8000 employees to 700 guys following the direction of a random guy making crucial business decisions off Twitter polls (lmao), and if anything it’s become slightly more popular and successful
- bfgoodrich 4y ago
- raydev 4y ago> if anything it’s become slightly more popular and successful Twitter made $5bil in 2021. Do you really think this or the next quarter, post-Musk acquisition, post-him running off big name advertisers, will even approach any of the worst quarters from the last 3 or 4 years under previous management? He has all the data. We know for certain Musk would be shouting from the rooftops if that brief burst of Twitter Blue subs made any real dent in revenue.
- deleted 4y ago[deleted]
- AtNightWeCode 4y agoLOL, why, just wow.
- AtNightWeCode 4y agoWow, top score for uniqueness, in the field of being stupid...
- marginalia_nu 4y agoDid an inventory based on my crawler data a while back. Relatively common to find sensitive or embarassing links singled out in robots.txt Especially in old large organizations, like universities.
- tacker2000 4y agoIts just random cms bs. Nothing to hate elon about
- hackernewds 4y agoImagine the guy at the helm here is now responsible for the most sensitive DMs of premiers and state leaders
- reaperducer 4y agoIf you think .gitignore leaks too much info, you're going to love https://www.tesla.com/robots.txt https://www.tesla.com/robots.txt I wonder if these are some of the same people that Musk brought in to refactor Twitter.