Twitter's Vine source code dump • Hacker News Board

Re: Twitter's Vine source code dump

#21

Post by jsprogrammer » Sat, Jul 23, 2016, 3:24 PM UTC

jondubois wrote: post #8

If that is true, that is seriously silly on behalf of Vine. Multiple major security flaws: 1. Company source code should only be published to private docker images. 2. You should never store API keys or passwords inside the source code. A better approach is to use environment variables and have the container read those.

#1 only applies to companies wanting to keep their code secret. Companies with all open source code do not need to publish to private repos/images.

Re: Twitter's Vine source code dump

#22

Post by jondubois » Sat, Jul 23, 2016, 3:58 PM UTC

theli0nheart wrote: post #15

jondubois wrote: post #8

If that is true, that is seriously silly on behalf of Vine. Multiple major security flaws: 1. Company source code should only be published to private docker images. 2. You should never store API keys or passwords inside the source code. A better approach is to use environment variables and have the container read those.

I completely disagree with #2. It's incredibly valuable and helpful to be able to use source control to track API key updates. Unlike environment variables, this forces accountability whenever a change to your configuration is made. If you're worried about security, you can always encrypt the individual keys.

Sure it's OK if you have a small team and you can trust everyone on that team. But if you are in a big company with thousands of employees, you don't want a 'rogue' employee (or contractor ...ala Snowden) to start accessing and messing with your services without company approval - The fewer employees know the company access keys and passwords, the better.

Re: Twitter's Vine source code dump

#23

Post by jondubois » Sat, Jul 23, 2016, 4:02 PM UTC

jsprogrammer wrote: post #21

jondubois wrote: post #8

If that is true, that is seriously silly on behalf of Vine. Multiple major security flaws: 1. Company source code should only be published to private docker images. 2. You should never store API keys or passwords inside the source code. A better approach is to use environment variables and have the container read those.

#1 only applies to companies wanting to keep their code secret. Companies with all open source code do not need to publish to private repos/images.

Yep, for sure #1 is not as important. But I doubt Twitter would want that kind of business logic open sourced.

Re: Twitter's Vine source code dump

#24

Post by GordonS » Sat, Jul 23, 2016, 7:18 PM UTC

uxp wrote: post #19

okket wrote: post #6

Can you please change the title from "Twitter's Vine Source code dump" to something that does not suggest that there is actual source code available?

I don't see any issue with this title. A "source code dump" is usually an act of vandalism, as opposed to a "source code release", or "released as open source". Additionally, there was source code available. It appeared that Vine was/is written in an interpreted language, so by downloading the wwwroot Docker image, the author was capable of reading the entirety of the Vine application code without any weird decompila…

Disagree. 'dump' strongly implies that the link is to a source code dump. Just changing 'dump' to 'dumped' would more accurately reflect the content of the article.