3 ms·

Well, I'd personally at least find some hilarity in being a Twitter engineer fired by one of those 10x Tesla engineers while they're publishing their .gitignore

by Hamuko 4y ago

Well, I'd personally at least find some hilarity in being a Twitter engineer fired by one of those 10x Tesla engineers while they're publishing their .gitignore files via HTTPS (which probably means that their Nginx configuration is fucked).

deleted 4y ago
[deleted]
jongjong 4y ago
It's barely a vulnerability. Many open source projects have theirs public. It might be a problem if the company's system was terrible and relied on security through obscurity; but maybe they don't care. The engineers who think it's a big deal may have tunnel vision. That can happen if you spend years in a very narrow area.
- sofixa 4y ago
  It's standard practice not to serve any hidden files (starting with .) over HTTP. The fact that .gitignore is served can indicate they don't block .paths, so lots of other things could slip through (.aws for instance).
  - naniwaduni 4y ago
    Is that a standard now? Who's going to tell the guys using .well-known?
    - sofixa 4y ago
      It has always been standard, it was the #1 thing to do when setting up Apache back when Apache was the standard and nginx was still this obscure Russian porn web server. .well-known is much more recent and an exception. Can you think of any other .file or .folder which is wise to be exposed publicly?
      - charcircuit 4y ago
        That is an apacheism to avoid serving .htaccess which can include hashed passwords. It's not a general thing.
      - morelisp 4y ago
        .plan
      - TheHappyOddish 4y ago
        I was around back then and uploading websites, (version controlling on svn, not git), and I do not recall it being a standard. The closest standard I can think of is .htaccess files (which we did upload) for various vhost specific settings. What is your basis for this standard? Was there a mailing list agreement I missed?
    - Karrot_Kream 4y ago
      Mastodon actually uses .well-known for Webfinger stuf.
  - BenjiWiebe 4y ago
    Are you sure it isn't .ht* that's blocked? That's what the default config is on my system.
prepend 4y ago
This is not an issue and just means that their wwwroot probably comes from a repo. Anyone who judges an engineer who made this decision poorly is silly. I’d say it’s closer to good thing than bad thing due to simplicity.
- nolok 4y ago
  Not parent you are answering to, and I don't have a dog in this "elon is a god"/"elon is the devil" fight, but let's stay factual: while the .gitignore is not an issue at all, serving dot files should virtually never be done
- Hamuko 4y ago
  >I’d say it’s closer to good thing than bad thing due to simplicity. Unless they intended to publish their .gitignore, I'd say it's closer to a bad thing than to a good thing to have random files from your repository open to the public. The simplest S3 permissions is to allow "*" publically too, but simple doesn't make it better.
randomsearch 4y ago
https://xkcd.com/932/ https://xkcd.com/932/ I look forward to meeting the Tesla engineers who work on their core tech and also their webpage.

by Hamuko 4y ago

deleted 4y ago

[deleted]

jongjong 4y ago

It's barely a vulnerability. Many open source projects have theirs public. It might be a problem if the company's system was terrible and relied on security through obscurity; but maybe they don't care. The engineers who think it's a big deal may have tunnel vision. That can happen if you spend years in a very narrow area.

sofixa 4y ago
It's standard practice not to serve any hidden files (starting with .) over HTTP. The fact that .gitignore is served can indicate they don't block .paths, so lots of other things could slip through (.aws for instance).
- naniwaduni 4y ago
  Is that a standard now? Who's going to tell the guys using .well-known?
  - sofixa 4y ago
    It has always been standard, it was the #1 thing to do when setting up Apache back when Apache was the standard and nginx was still this obscure Russian porn web server. .well-known is much more recent and an exception. Can you think of any other .file or .folder which is wise to be exposed publicly?
    - charcircuit 4y ago
      That is an apacheism to avoid serving .htaccess which can include hashed passwords. It's not a general thing.
    - morelisp 4y ago
      .plan
    - TheHappyOddish 4y ago
      I was around back then and uploading websites, (version controlling on svn, not git), and I do not recall it being a standard. The closest standard I can think of is .htaccess files (which we did upload) for various vhost specific settings. What is your basis for this standard? Was there a mailing list agreement I missed?
  - Karrot_Kream 4y ago
    Mastodon actually uses .well-known for Webfinger stuf.
- BenjiWiebe 4y ago
  Are you sure it isn't .ht* that's blocked? That's what the default config is on my system.

prepend 4y ago

This is not an issue and just means that their wwwroot probably comes from a repo. Anyone who judges an engineer who made this decision poorly is silly. I’d say it’s closer to good thing than bad thing due to simplicity.

nolok 4y ago
Not parent you are answering to, and I don't have a dog in this "elon is a god"/"elon is the devil" fight, but let's stay factual: while the .gitignore is not an issue at all, serving dot files should virtually never be done
Hamuko 4y ago
>I’d say it’s closer to good thing than bad thing due to simplicity. Unless they intended to publish their .gitignore, I'd say it's closer to a bad thing than to a good thing to have random files from your repository open to the public. The simplest S3 permissions is to allow "*" publically too, but simple doesn't make it better.

randomsearch 4y ago

https://xkcd.com/932/ https://xkcd.com/932/ I look forward to meeting the Tesla engineers who work on their core tech and also their webpage.