Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress base configuration files on GitHub

github.com

Post reply on HN
Print view View original

31–40 of 90 posts

Re: WordPress base configuration files on GitHub

#31

Post by aikah »

What is there to say ... developers , don't dump your projects on github public repositories ... use bitbucket and free private repos if you can't afford to pay FOR GOD SAKE !!! ...

!!! How many of them use the same credentials for their emails ? facebook ? twitter ? for their AWS account ? this is a nightmare.

Re: WordPress base configuration files on GitHub

#33

Post by mjolk »

nadams wrote: post #25

You do know that you can play the same game with other languages as well? https://github.com/search?utf8=%E2%9C%93&q=filename%3Asettin... I feel like people don't accept the fact that people do stupid stuff in other languages.

I think you're being oversensitive about PHP.

Wordpress, and by extension, its predictably-named settings file, is an easy search-target because it's very popular among novice/new developers.

Re: WordPress base configuration files on GitHub

#34

Post by 0x0 »

ishener wrote: post #16
JosephRedfern wrote: post #10

Earlier quoted context omitted.

How can you tell that? Just because it specifies "localhost" doesn't necessarily mean it's a dev box.

Exactly. Also remember that on many many wordpress servers you also have phpMyAdmin. You can use the username + password to login, and you'll get access even when it's restricted to localhost.

It's pretty scary to have phpMyAdmin public facing. IIRC some older versions of mysql-server even had a bug where it'd let you in with a random password in 1/256 chance!

Re: WordPress base configuration files on GitHub

#35

Post by jessaustin »

reustle wrote: post #21
ins0 wrote: post #18

Earlier quoted context omitted.

I agree with mahouse and of course are some of these password legit. But this is nothing new, don't store sensitive data in git. Everyone know you can search this stuff on GitHub and if we look back - Google was a nice password search engine too (and still today)

Don't store sensitive data in git, or don't store sensitive data on public github repos?

If there's any question, I think the rule has to be the former. There are standard, auditable ways to keep sensitive data out of git: .gitignore, environmental vars, etc. Once it's in git, any attempts to keep it out of a public repo will probably be manual and ad hoc.

If the organization is "closed" by default, i.e. it only rarely releases code to the public, this may not matter as much.

Re: WordPress base configuration files on GitHub

#38

Post by jessaustin »

archimedespi wrote: post #30
reustle wrote: post #21

Earlier quoted context omitted.

Don't store sensitive data in git, or don't store sensitive data on public github repos?

Don't even store sensitive data in git , it can be a bad idea: http://www.jamiembrown.com/blog/one-in-every-600-websites-ha... Store credentials in environment variables.

That link is talking about a problem with e.g. .htaccess and basic directory permissions, not a problem using git per se. But yeah, put that stuff in envars.

Re: WordPress base configuration files on GitHub

#40

Post by Huggernaut »

archimedespi wrote: post #30
reustle wrote: post #21

Earlier quoted context omitted.

Don't store sensitive data in git, or don't store sensitive data on public github repos?

Don't even store sensitive data in git , it can be a bad idea: http://www.jamiembrown.com/blog/one-in-every-600-websites-ha... Store credentials in environment variables.

How would you go about making a repeatable, automated deployment if you don't store configuration information in source control to load into the environment variables?
Post reply on HN