Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please stop serving .git to the outside world

pythonsweetness.tumblr.com

Post reply on HN
Print view View original

41–50 of 91 posts

Re: Please stop serving .git to the outside world

#41

Post by astrodust »

devmach wrote: post #38
astrodust wrote: post #33

Earlier quoted context omitted.

No. Not this. index.html has no business being in the root of your project. Always, and I mean always put your web content into a directory separate from the root of your .git archive. This is the easiest way to avoid all of these problems. Rails calls this directory "public", but it could be whatever you want, so long as what's mounted on your web server is not the root.

* Any folder in your project can have index.html and indeed it should have. * Parent talks about static pages, not about rails-ruby/php/python project. But i get your point : If somehow somebody screw with servers config, there is a risk to expose your apps files & configs. You can follow parents advice but set your root path in apache/nginx config to /var/www/www.example.org/public instead of /var/www/www.example.or…

Even a static site can be structured so that the .git directory is outside of the main public mount.

This gives you a natural place to store notes, documentation, and other non-public content.

It's not about screwing with the server config, it's so that it takes several stupid mistakes before your .git folder is flapping in the breeze, not just one. Being one configuration directive away from embarrassing failure is not a good idea.

Re: Please stop serving .git to the outside world

#42

Post by marijn »

This is too much of blanket statement. As long as there's nothing secret in the repository, serving up .git is perfectly fine. Both http://codemirror.net and http://ternjs.net (projects by me) have websites that are simply checkouts of the projects' repositories. Which were already public.

Re: Please stop serving .git to the outside world

#43

Post by astrodust »

brown9-2 wrote: post #29
dsirijus wrote: post #22

Earlier quoted context omitted.

You can hide it very easily with any of the virtual host syntax, and it's easy to deploy that way. I say, why not.

You could also very easily add one additional command to your deploy script to copy all the web content from the directory being pulled to to the web root, and not have to worry about any accidents.

Or you could set the web root to be that directory.

Re: Please stop serving .git to the outside world

#44

Post by drdaeman »

calpaterson wrote: post #37
hdra wrote: post #32

Earlier quoted context omitted.

I'm curious, what security risk does static content could pose by serving the .git ?

If you don't expect your source code to be made public and don't take care to keep secrets out of it, then you will be surprised when attackers have (for example) your cookie signing key. I know checking secrets into source code is already a bad practice, but accidental publication takes bad practice and makes it a security hole.

Parent post was asking about static content, not dynamic. No code to keep secret.

Re: Please stop serving .git to the outside world

#46

Post by beaumartinez »

stouset wrote: post #30
beaumartinez wrote: post #15

Earlier quoted context omitted.

Well, it could contain OAuth tokens for external services (eg Twitter), as well as secret tokens (used in Rails, Django for cookies). Worse still, they could be using passwords in an external service (eg, for a database) and have included those as well.

Stop putting shit like this in your repo. Developers should not have access to credentials that make their way onto production.

So how else should they handle them? Assuming the repo is private, keeping keys in the repo is the most frictionless way to ensure everyone has everything set up correctly.

Environment variables get annoying quickly if you ever need different ones for different projects, and if you create a shell script (or Vagrantfile) to do it for you, you're still keeping the keys in the repo.

Re: Please stop serving .git to the outside world

#47

Post by rlx0x »

astrodust wrote: post #41
devmach wrote: post #38

Earlier quoted context omitted.

* Any folder in your project can have index.html and indeed it should have. * Parent talks about static pages, not about rails-ruby/php/python project. But i get your point : If somehow somebody screw with servers config, there is a risk to expose your apps files & configs. You can follow parents advice but set your root path in apache/nginx config to /var/www/www.example.org/public instead of /var/www/www.example.or…

Even a static site can be structured so that the .git directory is outside of the main public mount. This gives you a natural place to store notes, documentation, and other non-public content. It's not about screwing with the server config, it's so that it takes several stupid mistakes before your .git folder is flapping in the breeze, not just one. Being one configuration directive away from embarrassing failure is…

> Being one configuration directive away from embarrassing failure is not a good idea.

I can't stop but thinking about PHP webapps, for instance Wordpress serves wp-index.php in the same directory as wp-config.php, indeed only one configuration directive away from blowing it all up in your face.

Every few months or so I encounter a huge site that serves me PHP source code. For instance the BBC: http://www.bbc.co.uk/radio4/hitchhikers/zmachine/hhguide.xml

But hey its PHP I guess anyone who would care about something like that has stopped using it years ago.

Re: Please stop serving .git to the outside world

#48

Post by krapp »

rlx0x wrote: post #47
astrodust wrote: post #41

Earlier quoted context omitted.

Even a static site can be structured so that the .git directory is outside of the main public mount. This gives you a natural place to store notes, documentation, and other non-public content. It's not about screwing with the server config, it's so that it takes several stupid mistakes before your .git folder is flapping in the breeze, not just one. Being one configuration directive away from embarrassing failure is…

> Being one configuration directive away from embarrassing failure is not a good idea. I can't stop but thinking about PHP webapps, for instance Wordpress serves wp-index.php in the same directory as wp-config.php, indeed only one configuration directive away from blowing it all up in your face. Every few months or so I encounter a huge site that serves me PHP source code. For instance the BBC: http://www.bbc.co.uk/r…

Why in the world would anyone serve a php file as .xml? That seems to be the problem... xml files are meant to be readable as text.

Re: Please stop serving .git to the outside world

#49

Post by _wmd »

marijn wrote: post #42

This is too much of blanket statement. As long as there's nothing secret in the repository, serving up .git is perfectly fine. Both http://codemirror.net and http://ternjs.net (projects by me) have websites that are simply checkouts of the projects' repositories. Which were already public.

This is pretty much a blanket statement for any project of reasonable size (or even with just a sole clueless developer). But don't take my word for it, check the evidence first hand by poking around the list for yourself :)

The solution is so effortless that it seems indefensible to serve .git, when the risk of doing so is a fleeting moment of forgetfulness leading to your site and databases getting pwned. Kind of like /etc/passwd being "public" so long as nobody puts their password in their GECOS field. Why take the risk.

Re: Please stop serving .git to the outside world

#50

Post by apendleton »

_wmd wrote: post #49
marijn wrote: post #42

This is too much of blanket statement. As long as there's nothing secret in the repository, serving up .git is perfectly fine. Both http://codemirror.net and http://ternjs.net (projects by me) have websites that are simply checkouts of the projects' repositories. Which were already public.

This is pretty much a blanket statement for any project of reasonable size (or even with just a sole clueless developer). But don't take my word for it, check the evidence first hand by poking around the list for yourself :) The solution is so effortless that it seems indefensible to serve .git, when the risk of doing so is a fleeting moment of forgetfulness leading to your site and databases getting pwned. Kind of l…

No, it really isn't a blanket statement. Almost all of my organization's web properties are public github repos (yay, non-profit organizations!). I doubt any of our properties serve .git, but that's just for technical architecture reasons (they're mostly Django apps), and there's literally nothing in the .git directories that isn't already available for free.
Post reply on HN