News for hackers. Stuff that matters.

A comment on WordPress base configuration files on GitHub. Parent comment

Re:WordPress base configuration files on GitHub by ins0 on Monday August 17, 2015 @10:02AM (#10072991)
I agree with mahouse and of course are some of these password legit. But this is nothing new, don't store sensitive data in git. Everyone know you can search this stuff on GitHub and if we look back - Google was a nice password search engine too (and still today)
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by reustle on Monday August 17, 2015 @10:05AM (#10073012)
Don't store sensitive data in git, or don't store sensitive data on public github repos?
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by archimedespi on Monday August 17, 2015 @10:14AM (#10073067)
Don't even store sensitive data in git, it can be a bad idea: http://www.jamiembrown.com/blog/one-in-every-600-websites-ha...

Store credentials in environment variables.

[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by Huggernaut on Monday August 17, 2015 @10:30AM (#10073184)
How would you go about making a repeatable, automated deployment if you don't store configuration information in source control to load into the environment variables?
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by aaronbasssett on Monday August 17, 2015 @10:52AM (#10073377)
Depends on what you're using for your deployments, for example if you were using Puppet you might use something like https://github.com/TomPoulton/hiera-eyaml
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by Huggernaut on Tuesday August 18, 2015 @03:37AM (#10077984)
Sorry, how does this prevent you requiring configuration in source control, or are you just suggesting that those credentials should be encrypted?
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by archimedespi on Monday August 17, 2015 @01:05PM (#10074462)
Consul and Vault go a long way to achieving that.

https://consul.io/

https://vault.io

[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by Huggernaut on Tuesday August 18, 2015 @03:37AM (#10077980)
Doesn't this just push the problem up (down?) a level in the hierarchy? I mean, you still need to deploy these and configure them with the information the rest of your deployment requires right?
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by jessaustin on Monday August 17, 2015 @10:28AM (#10073168)
That link is talking about a problem with e.g. .htaccess and basic directory permissions, not a problem using git per se. But yeah, put that stuff in envars.
[ Parent | on HN ]
Re:WordPress base configuration files on GitHub by jessaustin on Monday August 17, 2015 @10:20AM (#10073102)
If there's any question, I think the rule has to be the former. There are standard, auditable ways to keep sensitive data out of git: .gitignore, environmental vars, etc. Once it's in git, any attempts to keep it out of a public repo will probably be manual and ad hoc.

If the organization is "closed" by default, i.e. it only rarely releases code to the public, this may not matter as much.

[ Parent | on HN ]