From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.emacs.gnus.general/75249 Path: news.gmane.org!not-for-mail From: Ted Zlatanov Newsgroups: gmane.emacs.gnus.general Subject: Re: Add note about Oort Gnus releases, and No Gnus. Date: Sat, 18 Dec 2010 10:08:53 -0600 Organization: =?utf-8?B?0KLQtdC+0LTQvtGAINCX0LvQsNGC0LDQvdC+0LI=?= @ Cienfuegos Message-ID: <87k4j7dpwq.fsf@lifelogs.com> References: <87eia67lxj.fsf@topper.koldfront.dk> <871v667ger.fsf@topper.koldfront.dk> <87lj3slziq.fsf@lifelogs.com> <87oc8lzb3v.fsf_-_@topper.koldfront.dk> <87r5dh7650.fsf@lifelogs.com> <87ipys4hb8.fsf@lifelogs.com> <877hf7glmk.fsf@lifelogs.com> <874oabnm4x.fsf@topper.koldfront.dk> <87wrn7dro5.fsf@lifelogs.com> <87zks3m6gu.fsf@topper.koldfront.dk> NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Trace: dough.gmane.org 1292688603 20495 80.91.229.12 (18 Dec 2010 16:10:03 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Sat, 18 Dec 2010 16:10:03 +0000 (UTC) To: ding@gnus.org Original-X-From: ding-owner+M23604@lists.math.uh.edu Sat Dec 18 17:09:54 2010 Return-path: Envelope-to: ding-account@gmane.org Original-Received: from util0.math.uh.edu ([129.7.128.18]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1PTzM1-00007J-NP for ding-account@gmane.org; Sat, 18 Dec 2010 17:09:54 +0100 Original-Received: from localhost ([127.0.0.1] helo=lists.math.uh.edu) by util0.math.uh.edu with smtp (Exim 4.63) (envelope-from ) id 1PTzLJ-0005jT-2P; Sat, 18 Dec 2010 10:09:09 -0600 Original-Received: from mx2.math.uh.edu ([129.7.128.33]) by util0.math.uh.edu with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1PTzLH-0005jH-KA for ding@lists.math.uh.edu; Sat, 18 Dec 2010 10:09:07 -0600 Original-Received: from quimby.gnus.org ([80.91.231.51]) by mx2.math.uh.edu with esmtp (Exim 4.72) (envelope-from ) id 1PTzLF-00062m-R8 for ding@lists.math.uh.edu; Sat, 18 Dec 2010 10:09:06 -0600 Original-Received: from lo.gmane.org ([80.91.229.12]) by quimby.gnus.org with esmtp (Exim 4.72) (envelope-from ) id 1PTzLF-0002JG-3m for ding@gnus.org; Sat, 18 Dec 2010 17:09:05 +0100 Original-Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1PTzLE-0008D3-HC for ding@gnus.org; Sat, 18 Dec 2010 17:09:04 +0100 Original-Received: from c-67-186-102-106.hsd1.il.comcast.net ([67.186.102.106]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 18 Dec 2010 17:09:04 +0100 Original-Received: from tzz by c-67-186-102-106.hsd1.il.comcast.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 18 Dec 2010 17:09:04 +0100 X-Injected-Via-Gmane: http://gmane.org/ Original-Lines: 54 Original-X-Complaints-To: usenet@dough.gmane.org X-Gmane-NNTP-Posting-Host: c-67-186-102-106.hsd1.il.comcast.net X-Face: bd.DQ~'29fIs`T_%O%C\g%6jW)yi[zuz6;d4V0`@y-~$#3P_Ng{@m+e4o<4P'#(_GJQ%TT= D}[Ep*b!\e,fBZ'j_+#"Ps?s2!4H2-Y"sx" User-Agent: Gnus/5.110011 (No Gnus v0.11) Emacs/24.0.50 (gnu/linux) Cancel-Lock: sha1:vBCnitYOgBKYmo77CsEchnpFx9o= X-Spam-Score: -1.9 (-) List-ID: Precedence: bulk Xref: news.gmane.org gmane.emacs.gnus.general:75249 Archived-At: On Sat, 18 Dec 2010 16:44:01 +0100 asjo@koldfront.dk (Adam Sjøgren) wrote: AS> On Sat, 18 Dec 2010 09:30:50 -0600, Ted wrote: >> I trust chmod, chown, rsync, install/ginstall, and cfengine and Puppet >> (and similar sysadmin tools). AS> Only the first three come in to play here, right? My point was these tools were written to do file and system management and Git wasn't. If I wanted to do file management through Git I'd use etckeeper (http://kitenet.net/~joey/code/etckeeper/) or something like that, but I thought that was overkill. >> But Git was not written to manage file deployments or be secure so I >> don't trust it to do it right. AS> I'm probably being dense, but what exactly is it you expect git to do AS> wrong insecurely? The two problems are separate: 1) Git is not a release or deployment manager, it's a DVCS. It doesn't have the facilities to do that, which is why etckeeper and others like it have emerged. So look at the features of etckeeper, for instance, to see where Git falls short for file deployments. 2) Git is not written with security in mind, which is an architectural issue. You can look in the Git mailing list archives for plenty of discussion on that. >> The rsync step can be modified to exclude .htaccess, for instance, >> because it's a security risk. If you `git pull' a compromised repo, >> though, you're screwed. AS> Surely you can do the same step(s) that you would have rsync do, post AS> pull? No, because pulling in place means that at least for a little bit you have the wrong permissions on things. At best your site is broken, at worst you've opened a window of opportunity for an attacker. AS> Wouldn't you expect the machine to be compromised for the repository to AS> be so? The repository is remotely writeable. So I want to be really careful. It's tempting to hide the deployment process, but I'd rather not rely on security through obscurity. >> Also the .git directory under the HTML tree would bother me and is a >> potential security risk. AS> Again I am probably dense, but how would the content of .git pose a AS> security risk? It could be used by an attacker to hide files, for instance. Ted