search

team116 / TheScoutingSystem

A web-based scouting app for FRC competitions developed by team 116 Epsilon Delta.
0 stars 0 forks source link

Security #1

Open bollian opened 10 years ago

bollian commented 10 years ago
merscwog commented 10 years ago

Passwords ideally should never be kept as part of source code control. They should be maintained as a separate configuration if possible. If you want to keep "sensitive" things in a separate repository, then do that, but try to keep the main software working set open.

bollian commented 10 years ago

In my fork I've tried to solve this by having a file that is pullable but not pushable. This file would contain credentials that the code reads in to find information like, say, the mySQL root password (which is the whole reason I created this issue in the first place.) This doesn't seem easily achievable. Each person after their initial pull would have to enter the git update-index --assume-unchanged command if they don't want their passwords pushed up to the repository. I suppose creating a separate repository would work as well.

merscwog commented 10 years ago

Another common mechanism is to add the name of any password type file to the .gitignore file you can create at the top of the repo, to help ensure you never check it in.

bollian commented 10 years ago

Yes, but that only stops it from pulling/pushing if you've added the file the .gitignore before the file is created. So that would work, but everyone would have to create this file manually, which increases the risk of messing up formatting.

merscwog commented 10 years ago

.gitignore should only stop files from being added to staging to for commits (which would later be pushed). It should not affect checkouts or pulls. You'd check in a template file, which would need just some values adjusted. Someone who needs to alter that template (which should be rare) can still force add the file for commit.

From: watermelonduck notifications@github.com To: team116/TheScoutingSystem TheScoutingSystem@noreply.github.com Cc: Spencer Allain spencer_allain@yahoo.com Sent: Wednesday, September 3, 2014 3:27 PM Subject: Re: [TheScoutingSystem] Security (#1)

Yes, but that only stops it from pulling/pushing if you've added the file the .gitignore before the file is created. So that would work, but everyone would have to create this file manually, which increases the risk of messing up formatting. — Reply to this email directly or view it on GitHub.