Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress base configuration files on GitHub

github.com

Post reply on HN
Print view View original

81–90 of 90 posts

Re: WordPress base configuration files on GitHub

#81

Post by edpichler »

nocarrier wrote: post #63
edpichler wrote: post #48

Security experts, I have a question: if a database server just allow connections from a white list (trusted IP's), exposing database passwords on a GIT repository is still a problem?

It's not clear from your question if this hopefully hypothetical database server is exposed to the internet or if it's on a private network, but: Yes, it's still a problem, because then you have to depend on the whitelist staying valid and never having an admin accidentally turn it off. And you also have to depend on none of the machines on the trusted IPs being compromised either. And you have to depend on many othe…

I mean, if a database can be accessed only from a certain IP, like in Microsoft Azure.

Re: WordPress base configuration files on GitHub

#82

Post by krapp »

brightball wrote: post #28

At what point do developers get criticized/held responsible for using public repositories for private websites? I get it, people like github but when you can get a private repo on bitbucket for free there's no excuse for this.

This isn't a problem with public/private repositories. It's possible to commit the config files for Wordpress without exposing your passwords - you just have to not be lazy about it, and store the actual values in the environment or pull them from a file you don't commit with everything else.

Re: WordPress base configuration files on GitHub

#84

Post by toxican »

brewcore wrote: post #79

It's a good case for private repos, but an even better case for not committing passwords to a repository in the first place.

I don't even bother committing any part of wordpress core. I just commit the wp-content directory because unless you're a mad man, you shouldn't be modifying anything outside of that directory. First rule of WordPress is don't touch core! wp-config is definitely an exception, but better safe than sorry to avoid issues like this.

Re: WordPress base configuration files on GitHub

#85

Post by waffl »

_bozo wrote: post #6

Hmm. If you alter the search to "filename:wp-config.php FTP_PASS" you start getting some that look like ... legit. For those who don't know, WordPress has some level of access to hosting server via FTP, for upgrades and plugin installs. Pertinent config globals are FTP_BASE, FTP_CONTENT_DIR, FTP_PLUGIN_DIR, FTP_PUBKEY, FTP_PRIKEY, and of course, FTP_USER, FTP_PASS, FTP_HOST.

In a similar vein, things like this https://github.com/search?utf8=%E2%9C%93&q=filename%3Aid_rsa... are also why passwording your private keys is very important. Tons of these keys (why are people committing these to public repositories??) aren't passworded. It astounds me that someone has the technical knowledge to create an ssh key/pair, commit to github, and manage to send their unencrypted private key off into the public sphere.

Re: WordPress base configuration files on GitHub

#86

Post by nadams »

purephase wrote: post #75
bdcravens wrote: post #56

Earlier quoted context omitted.

Github does have a wider set of services that integrate with it. That said, if you have to go Github, private repos aren't that expensive. (And more services seem to be recognizing that Bitbucket is an increasingly popular options)

They are if you have to manage a lot of them. I love GH, but I only use it for my public projects. Limiting private repos ($200 for 125?) seems insane to me, and it will drive people to make public items that shouldn't be. For any private projects, or ones involving clients, I use BitBucket and make all repos private. It's a difference of $190 for me (I use the $10/mth plan with BB and host well over 125 private repo…

> I love GH, but I only use it for my public projects. Limiting private repos ($200 for 125?) seems insane to me, and it will drive people to make public items that shouldn't be.

But that's not really github's fault for people having public repos. For $20/month I can setup a VPS with my own source code hosting service (full management like gitlab) and host all the repos I want. I get people love the features of github - but they never really use them.

I would say people use public repos on github because they are lazy. And when people get nailed for uploading their Amazon AWS keys - they should really think about an alternative solution for their git repo needs.

Re: WordPress base configuration files on GitHub

#87

Post by Huggernaut »

archimedespi wrote: post #78
Huggernaut wrote: post #40

Earlier quoted context omitted.

How would you go about making a repeatable, automated deployment if you don't store configuration information in source control to load into the environment variables?

Consul and Vault go a long way to achieving that. https://consul.io/ https://vault.io

Doesn't this just push the problem up (down?) a level in the hierarchy? I mean, you still need to deploy these and configure them with the information the rest of your deployment requires right?

Re: WordPress base configuration files on GitHub

#88

Post by Huggernaut »

aaronbasssett wrote: post #65
Huggernaut wrote: post #40

Earlier quoted context omitted.

How would you go about making a repeatable, automated deployment if you don't store configuration information in source control to load into the environment variables?

Depends on what you're using for your deployments, for example if you were using Puppet you might use something like https://github.com/TomPoulton/hiera-eyaml

Sorry, how does this prevent you requiring configuration in source control, or are you just suggesting that those credentials should be encrypted?

Re: WordPress base configuration files on GitHub

#89

Post by mondainx »

danielsamuels wrote: post #64
mondainx wrote: post #62

I found this search more interesting than someone pushing their wp-config to a repo; also warning, some are nsfw https://github.com/search?p=100&q=filename%3Atits.jpg+&ref=s...

That link is a great example to demonstrate how much Github search sucks now. You've explicitly searched for filenames of "tits.jpg", but it's showing you a complete mishmash of different files.

I was surprised that it worked at all; I assumed some filtering would kill it right away.
Post reply on HN