Hacker News Reader

Comment by NewsAware | Hacker News Reader

He downloaded the source code, not the database, so no user data. Still questionable to some degree, one could demonstrate the problem without a full download

View on HN

Why do you think he "only" downloaded the source ? He wrote:

    I got 1.2 GB of data to go through. The data-set
    contained:

    Wordpress configuration files (yes, they use Wordpress)
    including hashed user credentials for the backend login
    
    Database passwords for production databases

    Log files

    A lot of PHP source code
    (who could have guessed?!)

    much more …

They publicly hosted their .git folder on their web server (which it says in the blog post). They had those things committed to version control (stupid) and publicly served it (stupid). Nothing was stolen.

If something is available via HTTP that you didn't want, how is it different than downloading HTML that you did? The protocol knows nothing about your intent.

Because that's not user data? That's code...

> Database passwords for production databases

You can use those to obtain user data.

> Log files

Easily could contain user data.

Reply on news.ycombinator.com