5 ms·

This shows that the teams in charge of code deployment have relatively weak quality control. In practice, it means that if the gitignore file is leaked, that t

by rvnx 4y ago

This shows that the teams in charge of code deployment have relatively weak quality control. In practice, it means that if the gitignore file is leaked, that there is a substantial risk that they accidentally leak the .git folder someday. The .git folder indirectly contains downloadable copies of the source-code of the website, which could very likely lead to credentials leak or compromised services. Your life can depend on Tesla.com services. Even if you are the pedestrian side.

bpodgursky 4y ago
I'd be pretty surprised if the marketing / landing site was remotely connected to the user portal. Most companies have a marketing-friendly CMS for public content, disconnected from the actual customer-facing portal.
- rvnx 4y ago
  Tesla.com seems to be more than marketing, at least customers can sign-in there to do cars operations,. If you can grab credentials from there you can do quite some things already. See https://www.teslaapi.io/authentication/oauth https://www.teslaapi.io/authentication/oauth (and this is in the case you don't trick an employee). But I agree, that normally at some point they would catch it.
extheat 4y ago
What makes you think that there is some "substantial risk"? You seem to be mixing together git repos and site deployment rules. I don't see the big deal here with some CMS leftovers being deployed, but yes from a perspective of correctness this is not something that needs to be deployed.
drexlspivey 4y ago
So basically everyone’s life is at risk because the .gitignore got leaked. That sounds reasonable.
mlindner 4y ago
> This shows that the teams in charge of website code deployment have relatively weak quality control. FTFY. Little of Tesla's software is whatever they're using on the website. That'd be like judging Apple OS software by their website source.
- rvnx 4y ago
  This is customer control panel, which directly leads to car APIs behind that are using the same credentials. On the same domain there is also the Tesla SSO. It would be bad if this gets compromised as there would be direct impact in the physical world, not just a static landing somewhere.
diogenesjunior 4y ago
what makes you think the tesla.com website is where they keep their real code lol?

by rvnx 4y ago

bpodgursky 4y ago

I'd be pretty surprised if the marketing / landing site was remotely connected to the user portal. Most companies have a marketing-friendly CMS for public content, disconnected from the actual customer-facing portal.

rvnx 4y ago
Tesla.com seems to be more than marketing, at least customers can sign-in there to do cars operations,. If you can grab credentials from there you can do quite some things already. See https://www.teslaapi.io/authentication/oauth https://www.teslaapi.io/authentication/oauth (and this is in the case you don't trick an employee). But I agree, that normally at some point they would catch it.

extheat 4y ago

What makes you think that there is some "substantial risk"? You seem to be mixing together git repos and site deployment rules. I don't see the big deal here with some CMS leftovers being deployed, but yes from a perspective of correctness this is not something that needs to be deployed.

drexlspivey 4y ago

So basically everyone’s life is at risk because the .gitignore got leaked. That sounds reasonable.

mlindner 4y ago

> This shows that the teams in charge of website code deployment have relatively weak quality control. FTFY. Little of Tesla's software is whatever they're using on the website. That'd be like judging Apple OS software by their website source.

rvnx 4y ago
This is customer control panel, which directly leads to car APIs behind that are using the same credentials. On the same domain there is also the Tesla SSO. It would be bad if this gets compromised as there would be direct impact in the physical world, not just a static landing somewhere.

diogenesjunior 4y ago

what makes you think the tesla.com website is where they keep their real code lol?