Hacker News Reader

Comment by jongjong | Hacker News Reader

If that's all the dirt that thousands of vengeful fired Twitter ex-employees could find, then Tesla must have excellent security.

View on HN

Yeah this screams complete and utter desperation. Like, I get that hating Elon is what all the cool kids at school are doing this month but do we really need this immature garbage on the front page of HN all day?

Yep, it seems like most of the posters here in this thread don’t do much software engineering from the looks of it. Or are being purposely obtuse here. There is no security vulnerability here in any of the links we’ve seen so far minus some unnecessarily deployed boilerplate. The gitignore file is not the same file your deployment tool uses when publishing a website. If there’s an API endpoint that is public opposed to some static asset, that would be a problem. Nothing we’ve seen here indicates that.

Honestly, all the Twitter acquisition has shown is how irrelevant to Twitter’s success the management team was. Twitter has gone from a sophisticated, large organization with 8000 employees to 700 guys following the direction of a random guy making crucial business decisions off Twitter polls (lmao), and if anything it’s become slightly more popular and successful

> if anything it’s become slightly more popular and successful

Twitter made $5bil in 2021. Do you really think this or the next quarter, post-Musk acquisition, post-him running off big name advertisers, will even approach any of the worst quarters from the last 3 or 4 years under previous management?

He has all the data. We know for certain Musk would be shouting from the rooftops if that brief burst of Twitter Blue subs made any real dent in revenue.

More than that, Twitter not has an extra $12 billion in debt, and $1b in interest payments due, which almost exceeds their quarterly revenue.

"more successful" how? Because Elon said so? If it's just about raw page impressions/activity, then perhaps for while since most of the western press is reporting and often directly linking to Twitter right now but what will happen once the media and their audience is bored of the drama and jumps to the next fad?

Do you really believe Twitter will become more profitable under Musk than before when even the new CEO already prepped the workers for a possible bankruptcy, a fat pending debt repayment date coming closer and advertisers running away?

Well, I'd personally at least find some hilarity in being a Twitter engineer fired by one of those 10x Tesla engineers while they're publishing their .gitignore files via HTTPS (which probably means that their Nginx configuration is fucked).

It's barely a vulnerability. Many open source projects have theirs public. It might be a problem if the company's system was terrible and relied on security through obscurity; but maybe they don't care. The engineers who think it's a big deal may have tunnel vision. That can happen if you spend years in a very narrow area.

It's standard practice not to serve any hidden files (starting with .) over HTTP. The fact that .gitignore is served can indicate they don't block .paths, so lots of other things could slip through (.aws for instance).

Is that a standard now? Who's going to tell the guys using .well-known?

It has always been standard, it was the #1 thing to do when setting up Apache back when Apache was the standard and nginx was still this obscure Russian porn web server.

.well-known is much more recent and an exception. Can you think of any other .file or .folder which is wise to be exposed publicly?

That is an apacheism to avoid serving .htaccess which can include hashed passwords. It's not a general thing.

.plan

I was around back then and uploading websites, (version controlling on svn, not git), and I do not recall it being a standard. The closest standard I can think of is .htaccess files (which we did upload) for various vhost specific settings.

What is your basis for this standard? Was there a mailing list agreement I missed?

Mastodon actually uses .well-known for Webfinger stuf.

Are you sure it isn't .ht* that's blocked? That's what the default config is on my system.

This is not an issue and just means that their wwwroot probably comes from a repo. Anyone who judges an engineer who made this decision poorly is silly.

I’d say it’s closer to good thing than bad thing due to simplicity.

Not parent you are answering to, and I don't have a dog in this "elon is a god"/"elon is the devil" fight, but let's stay factual: while the .gitignore is not an issue at all, serving dot files should virtually never be done

>I’d say it’s closer to good thing than bad thing due to simplicity.

Unless they intended to publish their .gitignore, I'd say it's closer to a bad thing than to a good thing to have random files from your repository open to the public.

The simplest S3 permissions is to allow "*" publically too, but simple doesn't make it better.

https://xkcd.com/932/

I look forward to meeting the Tesla engineers who work on their core tech and also their webpage.

People are just having some fun.

Reply on news.ycombinator.com