Using SVN makes your site extremely vulnerable

#1

Post by fdeth » Wed, Sep 23, 2009, 10:18 AM UTC

Using SVN makes your site extremely vulnerable
translate.google.com

Re: Using SVN makes your site extremely vulnerable

#2

Post by fdeth » Wed, Sep 23, 2009, 10:21 AM UTC

Sorry for the machine translation but an English text is not up just yet.

Re: Using SVN makes your site extremely vulnerable

#3

Post by InclinedPlane » Wed, Sep 23, 2009, 10:24 AM UTC

tl;dr Don't accidentally leave an svn working copy available to the internet, it could be a security vulnerability.

Re: Using SVN makes your site extremely vulnerable

#4

Post by ErrantX » Wed, Sep 23, 2009, 10:28 AM UTC

InclinedPlane wrote: post #3

tl;dr Don't accidentally leave an svn working copy available to the internet, it could be a security vulnerability.

Yes that was my thought too - at first I figured the translation was garbling what they were saying; I guess not.

Re: Using SVN makes your site extremely vulnerable

#5

Post by Sujan » Wed, Sep 23, 2009, 10:36 AM UTC

Using a working copy as your website is a pretty bad idea. That's what svn export is meant for.

Re: Using SVN makes your site extremely vulnerable

#6

Post by masklinn » Wed, Sep 23, 2009, 10:38 AM UTC

InclinedPlane wrote: post #3

tl;dr Don't accidentally leave an svn working copy available to the internet, it could be a security vulnerability.

Actually, TFA isn't about svn repositories but about using working copies for your production site, and leaving .svn world-readable. svn repositories tend to at least use some kind of HTTP auth (if not https or ssh), but a world-readable .svn means your whole project is available.

Re: Using SVN makes your site extremely vulnerable

#7

Post by masklinn » Wed, Sep 23, 2009, 10:40 AM UTC

Sujan wrote: post #5

Using a working copy as your website is a pretty bad idea. That's what svn export is meant for.

.

It's especially bad because svn puts a .svn in each directory. With e.g. mercurial or git, you can tuck the (visible) site in a subdirectory of the repo itself (project/pages), and the .hg/.git (project/.hg|project/.git) won't be accessible.

Of course the best option is still to use exports and symlinks.

Re: Using SVN makes your site extremely vulnerable

#8

Post by AndrewDucker » Wed, Sep 23, 2009, 10:43 AM UTC

It's not actually clear to me what the problem is.

Are they saying that people can read your code (not actually a problem for open source projects) or that they can update it and thus alter your site?

The former doesn't seem so bad - the latter is obviously catastrophic.

I wish I spoke Russian...

Re: Using SVN makes your site extremely vulnerable

#9

Post by hlidotbe » Wed, Sep 23, 2009, 10:44 AM UTC

Sujan wrote: post #5

Using a working copy as your website is a pretty bad idea. That's what svn export is meant for.

Using a working copy allows you to deploy your website faster and safer (only the changes gets transfered, you can have hooks to do some cleanup and rollbacks are almost free).

I use Mercurial on all my websites (disabling access to .*/.hg of course) and never use FTP for anything.

Re: Using SVN makes your site extremely vulnerable

#10

Post by InclinedPlane » Wed, Sep 23, 2009, 10:50 AM UTC

masklinn wrote: post #6

InclinedPlane wrote: post #3

tl;dr Don't accidentally leave an svn working copy available to the internet, it could be a security vulnerability.

Actually, TFA isn't about svn repositories but about using working copies for your production site, and leaving .svn world-readable. svn repositories tend to at least use some kind of HTTP auth (if not https or ssh), but a world-readable .svn means your whole project is available.

Yup, exactly. s/repositories/working copies/. I've been using git/hg too much lately.