Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress base configuration files on GitHub

github.com

Post reply on HN
Print view View original

61–70 of 90 posts

Re: WordPress base configuration files on GitHub

#63

Post by nocarrier »

edpichler wrote: post #48

Security experts, I have a question: if a database server just allow connections from a white list (trusted IP's), exposing database passwords on a GIT repository is still a problem?

It's not clear from your question if this hopefully hypothetical database server is exposed to the internet or if it's on a private network, but:

Yes, it's still a problem, because then you have to depend on the whitelist staying valid and never having an admin accidentally turn it off. And you also have to depend on none of the machines on the trusted IPs being compromised either. And you have to depend on many other things not happening as well.

Instead, you want what is called defense in depth--several layers of security so that an attacker needs to breach several defensive layers in order to get access to what they're looking for. Relying on just an IP whitelist as a single layer of defense is not considered to be a good practice.

https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

Re: WordPress base configuration files on GitHub

#64

Post by danielsamuels »

mondainx wrote: post #62

I found this search more interesting than someone pushing their wp-config to a repo; also warning, some are nsfw https://github.com/search?p=100&q=filename%3Atits.jpg+&ref=s...

That link is a great example to demonstrate how much Github search sucks now. You've explicitly searched for filenames of "tits.jpg", but it's showing you a complete mishmash of different files.

Re: WordPress base configuration files on GitHub

#65

Post by aaronbasssett »

Huggernaut wrote: post #40
archimedespi wrote: post #30

Earlier quoted context omitted.

Don't even store sensitive data in git , it can be a bad idea: http://www.jamiembrown.com/blog/one-in-every-600-websites-ha... Store credentials in environment variables.

How would you go about making a repeatable, automated deployment if you don't store configuration information in source control to load into the environment variables?

Depends on what you're using for your deployments, for example if you were using Puppet you might use something like https://github.com/TomPoulton/hiera-eyaml

Re: WordPress base configuration files on GitHub

#66

Post by hutch34 »

edpichler wrote: post #48

Security experts, I have a question: if a database server just allow connections from a white list (trusted IP's), exposing database passwords on a GIT repository is still a problem?

Definitely a good idea to whitelist ips, and, I'm certainly no security expert, but I still would avoid putting any type of credentials in a repository. Someone could have an ip reset, use a VPN tunnel, or any number of scenarios. I think it is better practice to use environment variables or something similar. Correct me if I'm wrong for those of you who are in security.

Re: WordPress base configuration files on GitHub

#67

Post by nadams »

mjolk wrote: post #33
nadams wrote: post #25

You do know that you can play the same game with other languages as well? https://github.com/search?utf8=%E2%9C%93&q=filename%3Asettin... I feel like people don't accept the fact that people do stupid stuff in other languages.

I think you're being oversensitive about PHP. Wordpress, and by extension, its predictably-named settings file, is an easy search-target because it's very popular among novice/new developers.

> I think you're being oversensitive about PHP.

I'm just tired of seeing the same search on github for PHP config files.

> its predictably-named settings file

So does every other popular application and framework on the planet. This isn't something specific to wordpress - we can play this game all day with different applications, frameworks, and languages.

https://github.com/search?q=mysql+user&type=Code&utf8=%E2%9C...

Post reply on HN