Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

One in every 600 websites has .git exposed

jamiembrown.com

Post reply on HN
Print view View original

31–40 of 214 posts

Re: One in every 600 websites has .git exposed

#31

Post by bbcbasic »

akerl_ wrote: post #21

It seems like if you're storing secrets and the like in your code's repo, the solution is to not do that, rather than just putting a bandaid over it by hiding the repo. Deploy the secrets separately: they don't belong in your site's codebase.

Hiding the repo is hardly a bandaid. It should never be exposed even if the repo is perfectly secret-free.

Except in the rare cases where it is intentional e.g. an open source repo and you happen to want people to download it from the same domain not github or git.domain.com.

Re: One in every 600 websites has .git exposed

#32

Post by pessimizer »

userbinator wrote: post #25

More precisely, it's "one in every 600 websites examined " Git is popular, but I find it hard to believe that 1/600 of all websites on the Internet use it.

You find it hard to believe that 0.17% of all websites use git? I'm sure 10x that many do, most probably don't misuse git to deploy rather than solely as a source code manager.

Re: One in every 600 websites has .git exposed

#33

Post by bbcbasic »

bsg75 wrote: post #22
markwakeford wrote: post #7

For Apache, Order deny,allow Deny from all Order allow,deny Deny from all https://serverfault.com/questions/128069/how-do-i-prevent-ap...

Would it be safer to not put .git within the reach of the webserver, and separate the development path from the production host path?

It certainly would, however like another comment I replied to ITT security doesn't have to be either-or it can be "do all the secure things".

I.e.

* No secrets in your repo

* Only copy to the server what you need (and automate this)

* Add conditions to your web server to not serve up .git, in-case the previous two checks failed.

When working in teams I think having additional checks and balances and not one 'perfect solution' is vital.

Re: One in every 600 websites has .git exposed

#34

Post by username »

317070 wrote: post #29

It seems Google doesn't like people looking into the extent of this problem [1]. When googleing for "inurl:.git", it returns no results. And on top of that, I need to enter a captcha first? [1] https://www.google.be/search?q=inurl%3A%22.git%22

The .git directory wouldn't be crawled though, correct?

Re: One in every 600 websites has .git exposed

#35

Post by shkkmo »

nmalaguti wrote: post #3

The author doesn't give any suggestions for alternative ways to deploy. What are the best practices here? What should operators that currently deploy this way do instead?

I personally prefer to have my web directory be a sub folder of the project root. This not only solves issues with .git directory be accessible but also helps prevent gotchas with exposing documentation or other data not intended for public consumption.

Re: One in every 600 websites has .git exposed

#36

Post by morninj »

markwakeford wrote: post #7

For Apache, Order deny,allow Deny from all Order allow,deny Deny from all https://serverfault.com/questions/128069/how-do-i-prevent-ap...

Better yet:

    $ rm -rf .git/
It's way safer to delete the repo history from the production server than to rely on Apache rules copied from a forum.

Re: One in every 600 websites has .git exposed

#37

Post by crindy »

pessimizer wrote: post #32
userbinator wrote: post #25

More precisely, it's "one in every 600 websites examined " Git is popular, but I find it hard to believe that 1/600 of all websites on the Internet use it.

You find it hard to believe that 0.17% of all websites use git? I'm sure 10x that many do, most probably don't misuse git to deploy rather than solely as a source code manager.

Most websites are made through Wordpress, Squarespace, Wix, and similar products. I bet the number here is far lower than 1/600.

Re: One in every 600 websites has .git exposed

#38

Post by markwakeford »

jqm wrote: post #24
markwakeford wrote: post #7

For Apache, Order deny,allow Deny from all Order allow,deny Deny from all https://serverfault.com/questions/128069/how-do-i-prevent-ap...

Don't you specifically have to configure Apache to allow access to dot directories in the first place? (disclaimer, I didn't read the article... but if access to dot directories were enabled.. ya, .git would be exposed, but I'm pretty sure it isn't the default Apache setting.)

As far as I knew .ht* is the only file(s) not accessible.

Re: One in every 600 websites has .git exposed

#39

Post by GuiA »

phantom_oracle wrote: post #30

Imagine you implement every type of possible security... Keeping your entire server-stack up-to-date, making sure you have SSL, using strong encryption for logging-in, hashing the passwords, making sure your server can only be reached via SSH, adding firewalls, filters, etc. etc. Then some hacker in Eastern Europe comes along (or some beginner at the NSA/GCHQ) and finds out that your .git is exposed and somehow gains…

Well, that's why you either have a team of competent people making sure all your stuff is up to date, routinely performing pentests, etc., or you delegate as much as possible of those responsibilities to 3rd parties (e.g. Heroku).

Re: One in every 600 websites has .git exposed

#40

Post by itg »

317070 wrote: post #29

It seems Google doesn't like people looking into the extent of this problem [1]. When googleing for "inurl:.git", it returns no results. And on top of that, I need to enter a captcha first? [1] https://www.google.be/search?q=inurl%3A%22.git%22

I often get captcha requests when doing any google search with inurl or intitle.
Post reply on HN