News for hackers. Stuff that matters.

A comment on One in every 600 websites has .git exposed. Parent comment

Re:One in every 600 websites has .git exposed by vog on Monday July 27, 2015 @09:59AM (#9955211)
Yes, it is easily avoided. But it is still violated by lots of PHP projects, including well-known projects with large userbases:

    * Wordpress
    * Tiki
    * ... and so on.
I don't think this is by accident: This technique is too old and well-known to be ignored by large projects. Rather, they conciously don't do that to cause less hassle for the occasional admin: Those can simply dump it into some directory and don't have to setup a proper docroot or anything. And extra work for those who want a more secure setup.

This is clearly a usability versus security issue, resolved in the unfortunate, usual way.

[ Parent | on HN ]
Re:One in every 600 websites has .git exposed by jbeales on Monday July 27, 2015 @10:51AM (#9955483)
I don't have insight into the decision-making at WordPress, but they probably do this because they want to be compatible with as many web hosts as possible, and so many super-cheap shared hosts just give you a public directory that you're supposed to dump everything in.

It's possible to set it up properly on most of these hosts, but it's much more difficult, and if you ever have issues the support team says you're using a "non-supported configuration." At least WordPress lets you move your config file one level above the webroot and will find it automatically.

[ Parent | on HN ]
Re:One in every 600 websites has .git exposed by juliangregorian on Monday July 27, 2015 @12:24PM (#9956132)
Drupal, MediaWiki, Laravel, Slim, it's a pretty long list, and it includes projects that target Serious Devlopers.
[ Parent | on HN ]
Re:One in every 600 websites has .git exposed by vog on Monday July 27, 2015 @12:35PM (#9956224)
Also, this is really PHP specific.

Look at any larger Python (Django/Flask/...) or Ruby (Rails/...) project, and you will always find a proper "public" directory, although it may be named differently.

Not sure about Perl though ...

[ Parent | on HN ]