Related question: Is there any risk to exposing .git if your Git repository is already publicly available (e.g. on GitHub)?
One in every 600 websites has .git exposed
11–20 of 214 posts
Re: One in every 600 websites has .git exposed
#12The author doesn't give any suggestions for alternative ways to deploy. What are the best practices here? What should operators that currently deploy this way do instead?
Besides what TheDong has suggested (hiding your .git folder from public view), you could also have a build server that in the end tarballs everything up and deploys it onto your live servers.
Perhaps you didn't read my response fully; after the initial 'simple solution', having a deployment artifact is exactly what I suggest.
Re: One in every 600 websites has .git exposed
#13Earlier quoted context omitted.
Probably better to link to the stackoverflow you quite possibly copied this from so that people can see discussion / alternatives, etc: https://serverfault.com/questions/128069/how-do-i-prevent-ap... See also the nginx question: https://stackoverflow.com/questions/2999353/how-do-you-hide-... Note, if you actually did take it from the stackoverflow, you just infringed on someone's copyright; SO's user content is 'crea…
I was busy editing it, thanks though. edit: sounded wayyy too snarky lol.
[deleted]
Re: One in every 600 websites has .git exposed
#14Related question: Is there any risk to exposing .git if your Git repository is already publicly available (e.g. on GitHub)?
No.
Re: One in every 600 websites has .git exposed
#15Related question: Is there any risk to exposing .git if your Git repository is already publicly available (e.g. on GitHub)?
If it's exactly the same repository - no. If it contains some extra branches with local changes, or potentially commits with private information / passwords - definitely.
So in general - it's better not to have it in the first place, because it's unlikely that the person doing the commits knows the whole deployment strategy.
Re: One in every 600 websites has .git exposed
#16The author doesn't give any suggestions for alternative ways to deploy. What are the best practices here? What should operators that currently deploy this way do instead?
I simply use a 'checkout' process where all website assets to be deployed are copied into for example a /dst folder and the folder then rsync'd to the webroot (with rsync -ru --delete --chmod). This avoids clutter and still allows to just update changed files. The actual page source is still under git.
Re: One in every 600 websites has .git exposed
#17I wonder what would happen if you searched for .svn, too. I'm sure you'd run into the same problem in many places. But would it be more or less likely to occur?
In svn's heyday, the standard way to install or update a popular app like WordPress was to download and extract a tarball. Only people who actually participated in the development of the app itself used svn.
Nowadays, lots of open-source projects encourage ordinary webmasters to clone a Github repo and run `git pull` to update.
So I suspect that public .svn folders will be less common.
Re: One in every 600 websites has .git exposed
#18Earlier quoted context omitted.
Besides what TheDong has suggested (hiding your .git folder from public view), you could also have a build server that in the end tarballs everything up and deploys it onto your live servers.
Perhaps you didn't read my response fully; after the initial 'simple solution', having a deployment artifact is exactly what I suggest.
Eh yep you're right. Should have read slower.
Re: One in every 600 websites has .git exposed
#19The author doesn't give any suggestions for alternative ways to deploy. What are the best practices here? What should operators that currently deploy this way do instead?
You can use git-archive (http://git-scm.com/docs/git-archive , examples provided at the bottom)
Re: One in every 600 websites has .git exposed
#20For Apache, Order deny,allow Deny from all Order allow,deny Deny from all https://serverfault.com/questions/128069/how-do-i-prevent-ap...
Probably better to link to the stackoverflow you quite possibly copied this from so that people can see discussion / alternatives, etc: https://serverfault.com/questions/128069/how-do-i-prevent-ap... See also the nginx question: https://stackoverflow.com/questions/2999353/how-do-you-hide-... Note, if you actually did take it from the stackoverflow, you just infringed on someone's copyright; SO's user content is 'crea…
Note, if you actually did take it from the stackoverflow, you just infringed on someone's copyright
Does a simple access rule, which I can't see there being many sane ways to express, meet the minimum level of creativity/originality to be eligible for copyright...?