Re: Add note about Oort Gnus releases, and No Gnus.

[Ted Zlatanov <tzz@lifelogs.com>]

On Sat, 18 Dec 2010 16:44:01 +0100 asjo@koldfront.dk (Adam Sjøgren) wrote: 

AS> On Sat, 18 Dec 2010 09:30:50 -0600, Ted wrote:
>> I trust chmod, chown, rsync, install/ginstall, and cfengine and Puppet
>> (and similar sysadmin tools).

AS> Only the first three come in to play here, right?

My point was these tools were written to do file and system management
and Git wasn't.  If I wanted to do file management through Git I'd use
etckeeper (http://kitenet.net/~joey/code/etckeeper/) or something like
that, but I thought that was overkill.

>> But Git was not written to manage file deployments or be secure so I
>> don't trust it to do it right.

AS> I'm probably being dense, but what exactly is it you expect git to do
AS> wrong insecurely?

The two problems are separate: 1) Git is not a release or deployment
manager, it's a DVCS.  It doesn't have the facilities to do that, which
is why etckeeper and others like it have emerged.  So look at the
features of etckeeper, for instance, to see where Git falls short for
file deployments.  2) Git is not written with security in mind, which is
an architectural issue.  You can look in the Git mailing list archives
for plenty of discussion on that.

>> The rsync step can be modified to exclude .htaccess, for instance,
>> because it's a security risk.  If you `git pull' a compromised repo,
>> though, you're screwed.

AS> Surely you can do the same step(s) that you would have rsync do, post
AS> pull?

No, because pulling in place means that at least for a little bit you
have the wrong permissions on things.  At best your site is broken, at
worst you've opened a window of opportunity for an attacker.

AS> Wouldn't you expect the machine to be compromised for the repository to
AS> be so?

The repository is remotely writeable.  So I want to be really careful.
It's tempting to hide the deployment process, but I'd rather not rely on
security through obscurity.

>> Also the .git directory under the HTML tree would bother me and is a
>> potential security risk.

AS> Again I am probably dense, but how would the content of .git pose a
AS> security risk?

It could be used by an attacker to hide files, for instance.

Ted