i\r
i Open .git directories are a bigger cybersecurity problem than\r
i many might imagine, at least according to a Czech security\r
-i researcher who discovered almost 400,000 web pages with an\r
+i researcher who [1]discovered almost 400,000 web pages with an\r
i open .git directory possibly exposing a wide variety of data.\r
-i From a report: Vladimir Smitka began his .git directory\r
-i odyssey in July when he began looking at Czech websites to\r
-i find how many were improperly configured and allow access to\r
-i their .git folders within the file versions repository. Open\r
-i .git directories are a particularly dangerous issue, he said,\r
-i because they can contain a great deal of sensitive\r
-i information. "Information about the website's structure, and\r
-i sometimes you can get very sensitive data such as database\r
-i passwords, API keys, development IDE settings, and so on.\r
-i However, this data shouldn't be stored in the repository, but\r
-i in previous scans of various security issues, I have found\r
-i many developers that do not follow these best practices,"\r
-i Smitka wrote. Smitka queried 230 million websites to discover\r
-i the 390,000 allowing access to their .git directories. The\r
-i vast majority of the websites with open directories had a .com\r
-i TLD with .net, .de, .org and uk comprising most of the others.\r
+i From a report:\r
+i \r
+i > Vladimir Smitka began his .git directory odyssey in July\r
+i when he began looking at Czech websites to find how many were\r
+i improperly configured and allow access to their .git folders\r
+i within the file versions repository. Open .git directories are\r
+i a particularly dangerous issue, he said, because they can\r
+i contain a great deal of sensitive information. "Information\r
+i about the website's structure, and sometimes you can get very\r
+i sensitive data such as database passwords, API keys,\r
+i development IDE settings, and so on. However, this data\r
+i shouldn't be stored in the repository, but in previous scans\r
+i of various security issues, I have found many developers that\r
+i do not follow these best practices," Smitka wrote. Smitka\r
+i queried 230 million websites to discover the 390,000 allowing\r
+i access to their .git directories. The vast majority of the\r
+i websites with open directories had a .com TLD with .net, .de,\r
+i .org and uk comprising most of the others.\r
+i \r
+i \r
+i \r
+i [1] https://www.scmagazine.com/home/news/400000-websites-vulne-\r
+i rable-through-exposed-git-directories/\r
i\r
git://git.nikiroo.be / gofetch.git / blobdiff