Apart from putting your wp-config on github, it's also a terrible idea to use short passwords like 'p@ss12' for a database password that will be sent from one machine/program to another most of the time - such passwords should at the very least look like 'jm0Y/ZGjxYZay2yraskQ5AbZ8Qe0r0pRVDdnEkaIvHU', computers can remember strings that long and developers can copy-paste if it's stored in a file already.
WordPress base configuration files on GitHub
71–80 of 90 posts
Re: WordPress base configuration files on GitHub
#72Security experts, I have a question: if a database server just allow connections from a white list (trusted IP's), exposing database passwords on a GIT repository is still a problem?
In any case where having passwords is relevant to security rather than just a hindrance to usability, exposing passwords is a security problem. If exposing a password isn't a security problem, you shouldn't require a password in the first place.
"Defense in depth" is a commonly accepted security principle that suggests otherwise:
Re: WordPress base configuration files on GitHub
#73Earlier quoted context omitted.
In any case where having passwords is relevant to security rather than just a hindrance to usability, exposing passwords is a security problem. If exposing a password isn't a security problem, you shouldn't require a password in the first place.
"Defense in depth" is a commonly accepted security principle that suggests otherwise: https://en.wikipedia.org/wiki/Defense_in_depth_(computing)
> "Defense in depth" is a commonly accepted security principle
Indeed.
> that suggests otherwise:
Except that it does no such thing. If you have passwords for defense in depth, they both exist for security reasons and it is a security problem to expose them (because you've just eliminated part of your depth.)
Defense in depth means that the problems of any one layer being violated are mitigated by additional layers of security, it doesn't mean it suddenly ceases to be a security problem if one of your measures is compromised. It just reduces the likely immediate severity of such a compromise, providing a greater chance of being able to effectively address it before it leads to an actual breach.
Re: WordPress base configuration files on GitHub
#74At what point do developers get criticized/held responsible for using public repositories for private websites? I get it, people like github but when you can get a private repo on bitbucket for free there's no excuse for this.
or just a bare repo on your server. I personally don't see the appeal of Github for private projects at all.
PRs, Issues, Wikis, etc.
Re: WordPress base configuration files on GitHub
#75At what point do developers get criticized/held responsible for using public repositories for private websites? I get it, people like github but when you can get a private repo on bitbucket for free there's no excuse for this.
Github does have a wider set of services that integrate with it. That said, if you have to go Github, private repos aren't that expensive. (And more services seem to be recognizing that Bitbucket is an increasingly popular options)
They are if you have to manage a lot of them.
I love GH, but I only use it for my public projects. Limiting private repos ($200 for 125?) seems insane to me, and it will drive people to make public items that shouldn't be.
For any private projects, or ones involving clients, I use BitBucket and make all repos private. It's a difference of $190 for me (I use the $10/mth plan with BB and host well over 125 private repos).
Re: WordPress base configuration files on GitHub
#76"Passwords" in the title is a bit misleading. Most of these are staging files with little or no sensitive information there. However there is the odd bit of interesting data there if you look hard enough. Github search is an untapped resource just like Algolia Search is on Hackernews. Infact I have largely replaced my Google searches with these ones for more refined and curated results.
What do you mean with staging files, what is not sensitive about username and password of the database?
Well a Wordpress production site is a rare and precious thing to find on Github. There are some that exist, but then even if I do find it:
1.) Password will be changed
2.) Possible honeypot
3.) Boring site is boring. No need to hack it. Not popular enough
Same goes for other databases on there. An enormous amount of cruft to wade through to get anything remotely juicy/interesting. And the same heuristics apply above: is it really so great that I logged into a boring MYSQL database that is probably being monitored and has nothing interesting in there in the first place?
Re: WordPress base configuration files on GitHub
#77"Passwords" in the title is a bit misleading. Most of these are staging files with little or no sensitive information there. However there is the odd bit of interesting data there if you look hard enough. Github search is an untapped resource just like Algolia Search is on Hackernews. Infact I have largely replaced my Google searches with these ones for more refined and curated results.
What do you mean with staging files, what is not sensitive about username and password of the database?
I think they mean that a majority of these are instances where someone installed WP to play with it and these are the testing files rather than an actual website they are using. When I installed WP recently, I know I just used a dummy password for testing.
Re: WordPress base configuration files on GitHub
#78Earlier quoted context omitted.
Don't even store sensitive data in git , it can be a bad idea: http://www.jamiembrown.com/blog/one-in-every-600-websites-ha... Store credentials in environment variables.
How would you go about making a repeatable, automated deployment if you don't store configuration information in source control to load into the environment variables?
Consul and Vault go a long way to achieving that.
Re: WordPress base configuration files on GitHub
#79It's a good case for private repos, but an even better case for not committing passwords to a repository in the first place.
Re: WordPress base configuration files on GitHub
#80Security experts, I have a question: if a database server just allow connections from a white list (trusted IP's), exposing database passwords on a GIT repository is still a problem?
Maybe the password is the same for the wp-admin user. Password reuse is a really serious and common problem.