One in every 600 websites has .git exposed

Re:One in every 600 websites has .git exposed by jsjohnst on Monday July 27, 2015 @12:23AM (#9953329)

Glad I don't work at your shop then. Environment variables are a terrible way to give your app secure information. There's well over a dozen reasons why you shouldn't do this in your apps, but one super obvious one is there's way to many frameworks that expose environment variables in their debug output if not properly configured. Think you'll never misconfigure a server? Guess again, pretty much every major site (Google, FB, Twitter, Yahoo, EBay, Microsoft, etc) have all done it at some point.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by tokenizerrr on Monday July 27, 2015 @05:16AM (#9954164)

Please review HN's guidelines on civility.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by jsjohnst on Monday July 27, 2015 @08:28AM (#9954709)

Fair point, I potentially should've left off the first sentence. I stand behind the rest of the post, but the first sentence is a bit on the edge and I apologize.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by tokenizerrr on Monday July 27, 2015 @08:32AM (#9954726)

Alright, well, I've never seen an application/framework spit out environment variables when it was misconfigured. But then again, I barely work with web-related stuff so maybe I just don't use the kind of software that does this. Could you provide some examples?

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by damon_c on Monday July 27, 2015 @09:36AM (#9955063)

Many web frameworks do this when in "debug" mode.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by dang on Monday July 27, 2015 @03:07PM (#9957292)

Your comment sounded more colloquial than uncivil to me, but thanks for responding so respectfully.

[ Parent | on HN ]

[dead]

Re:One in every 600 websites has .git exposed by tokenizerrr on Monday July 27, 2015 @07:11AM (#9954470)

I'm glad you made a new account named 'shutupbitch' just to tell me this. Thank you for your contribution.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by dang on Monday July 27, 2015 @03:06PM (#9957286)

Please don't feed trolls.

[ Parent | on HN ]

Re:One in every 600 websites has .git exposed by otterley on Tuesday July 28, 2015 @11:22PM (#9965993)

The "dump environment" problem is an issue for novice developers, but mature shops should have security-conscious frameworks for secrets handling that do things like clear the variable from the environment at initialization time.

What are your other 11 objections?

[ Parent | on HN ]