Tesla.com/.gitignore

https://www.tesla.com/.gitignore

by nateb2022 • 4 years ago

457 247 4 years ago

Can’t access it…

jjgreen• 4 years ago

    # Ignore configuration files that may contain sensitive information.
    sites/*/settings*.php
    
    # Ignore paths that contain user-generated content.
    sites/*/files
    sites/*/private

codetrotter• 4 years ago

Archived copy for reference https://archive.ph/C6qJ4

antman• 4 years ago

I think this site's code repository needs to be reviewed. Maybe should call some twitter engineers

dergachev• 4 years ago

Drupal

snapetom• 4 years ago

There was a posting just this week on a job site for a "Sr. Software Engineer, Backend Drupal" at Tesla. Putting together pieces like a leaked .gitignore file, job postings, etc. is social engineering in action.

viraptor• 4 years ago

That's not social engineering. You're not convincing anyone to do anything or share anything with you. This is OSINT.

arcturus17• 4 years ago

Does this not come as a surprise to anyone?

I'd have figured that they would have rolled out their own custom headless CMS or something really complex. I mean, not that it doesn't make sense for them to use a bog-standard CMS tool, but my biases (halo effect?) would have made me think that they use something more more unique.

rabuse• 4 years ago

Why over-engineer something that just doesn't bring much value to their company?

ElijahLynn• 4 years ago

Drupal is pretty powerful and there is a large talent pool for it, so it can probably handle all their CMS needs just fine. And that would be smart not to roll their own.

anonym298• 4 years ago

If you think .gitignore leaks too much info, you're going to love https://www.tesla.com/robots.txt

soneil• 4 years ago

The start/stop at the bottom makes that look like it's come canned with a CMS and they've just tacked on what they needed to. It's 90% boilerplate.

chx3• 4 years ago

It's hardly a secret tesla.com is Drupal -- both that gitignore and the robots.txt shouts it quite loudly, to be fair. One of the larger Drupal agencies, Lullabot includes them in their clients list: https://www.lullabot.com/our-work and they are looking for a sr backend Drupal engineer https://www.tesla.com/careers/search/job/sr-software-enginee... which I would take if the company were not lead by Musk.

Neil44• 4 years ago

And the bumph at the top - crawlers run by Yahoo! and Google - lol

m00x2• 4 years ago

Really doesn't leak much, and robot.txt is supposed to be accessible from the internet.

anonym298• 4 years ago

Yes, it's meant to be public, but you need not disclose all of what is contained inside of it. I've been on many pentests where paths provided by robots.txt, that I wouldn't have obtained any other way, led to exploitable vulnerabilities.

For some reason, a considerable number of people don't seem to think twice about adding sensitive paths to robots.

threatripper• 4 years ago

This looks like a default file from a Drupal installation: https://api.drupal.org/api/drupal/robots.txt/7.x

slaymaker1907• 4 years ago

Apparently Tesla is FOSS, see https://www.Tesla.com.

Ptchd2• 4 years ago

Where can I get the FSD (Fake Self Driving) source code?

jongjong2• 4 years ago

If that's all the dirt that thousands of vengeful fired Twitter ex-employees could find, then Tesla must have excellent security.

bakugo• 4 years ago

Yeah this screams complete and utter desperation. Like, I get that hating Elon is what all the cool kids at school are doing this month but do we really need this immature garbage on the front page of HN all day?

Hamuko2• 4 years ago

Well, I'd personally at least find some hilarity in being a Twitter engineer fired by one of those 10x Tesla engineers while they're publishing their .gitignore files via HTTPS (which probably means that their Nginx configuration is fucked).

jasonvorhe2• 4 years ago

People are just having some fun.

AtNightWeCode2• 4 years ago

LOL, why, just wow.

AtNightWeCode2• 4 years ago

Wow, top score for uniqueness, in the field of being stupid...

marginalia_nu• 4 years ago

Did an inventory based on my crawler data a while back.

Relatively common to find sensitive or embarassing links singled out in robots.txt

Especially in old large organizations, like universities.

tacker2000• 4 years ago

Its just random cms bs. Nothing to hate elon about

hackernewds• 4 years ago

Imagine the guy at the helm here is now responsible for the most sensitive DMs of premiers and state leaders

reaperducer• 4 years ago

If you think .gitignore leaks too much info, you're going to love https://www.tesla.com/robots.txt

I wonder if these are some of the same people that Musk brought in to refactor Twitter.

djegod• 4 years ago

Ask myself what other files will be exposed?

jbverschoor2• 4 years ago

So basically you run an endless script to fetch https://www.tesla.com/sites/default/settings.php and hope that some day there will be a minor nginx config error which lets you download the php source instead of executing it.

This will happen some day, so invest 5 bucks per month to exploit Tesla at a certain point, so maybe you can be first in line for the Cybertruck :-)

rvnx4• 4 years ago

This seems to be a too sophisticated attack, sometimes simplicity is better: https://samcurry.net/cracking-my-windshield-and-earning-1000...

j-bos• 4 years ago

Great read

walrus01• 4 years ago

Time to try naming your tesla "drop table vehicles;"

grubby• 4 years ago

this was such a great read, people like you make me want to learn more and more everyday

grumple• 4 years ago

Pretty sure every site on IPv4 gets probed multiple times a day for common config leaks and other misconfigurations. Happens to all of mine.

jbverschoor2• 4 years ago

Yeah, but if a gitignore tells you where to look for, and it isn't even blocked by a WAF / rule, it makes an interesting target, esp. one of the largest companies out there.

You shouldn't even be able to execute settings.php

c7DJTLrn• 4 years ago

Finally, a compelling reason to use IPv6.

TechBro86153• 4 years ago

This comment transported me back to 2010 or thereabouts when this happened to Facebook. I remember being surprised at the simplicity of the code and making a lot of jokes about "build a facebook clone" ads on freelance websites.

retrocryptid4• 4 years ago

Except that you'll find that error long before the cybertruck ships. Heck, you'll probably see the rebirth of NFTs and BTC over US$40000 before the cybertruck ships.

rbanffy8• 4 years ago

I am sure there are lots of automated scripts doing precisely that with pretty much every company that has a website.

I used to keep a hall of shame on my main site, because looking for "settings.php" or "global.asa" on a Zope site was just silly.

behnamoh• 4 years ago

Can someone explain why this is leaky and how it can be exploited by malicious actors?

bobthepanda• 4 years ago

The gitignore explicitly called out where the sensitive settings file is, so presumably that makes it a lot easier to figure out where to start injecting bad code

Alupis• 4 years ago

Sure, but this appears like some very standard directories for popular website CMS platforms like Drupal.

So, not very surprising and probably doesn't really tip anyone towards anything particularly special.

m00x2• 4 years ago

It's probably caused by an incorrect nginx configuration, which means other static files may be exposed.

Otherwise, it's not much of a leak.

rvnx4• 4 years ago

This shows that the teams in charge of code deployment have relatively weak quality control.

In practice, it means that if the gitignore file is leaked, that there is a substantial risk that they accidentally leak the .git folder someday.

The .git folder indirectly contains downloadable copies of the source-code of the website, which could very likely lead to credentials leak or compromised services.

Your life can depend on Tesla.com services.

Even if you are the pedestrian side.

bpodgursky• 4 years ago

I'd be pretty surprised if the marketing / landing site was remotely connected to the user portal. Most companies have a marketing-friendly CMS for public content, disconnected from the actual customer-facing portal.

extheat3• 4 years ago

What makes you think that there is some "substantial risk"? You seem to be mixing together git repos and site deployment rules. I don't see the big deal here with some CMS leftovers being deployed, but yes from a perspective of correctness this is not something that needs to be deployed.

drexlspivey• 4 years ago

So basically everyone’s life is at risk because the .gitignore got leaked. That sounds reasonable.

mlindner6• 4 years ago

This shows that the teams in charge of website code deployment have relatively weak quality control.

FTFY. Little of Tesla's software is whatever they're using on the website. That'd be like judging Apple OS software by their website source.

diogenesjunior2• 4 years ago

what makes you think the tesla.com website is where they keep their real code lol?

anonym298• 4 years ago

It's leaky because it's globally accessible and provides information that isn't otherwise readily apparent.

There is no guarantee that an exposed .gitignore (or other exposed files, like .htaccess, robots.txt, etc) will be exploitable, but they aid in the discovery process and may help adversaries uncover exploitable vulnerabilities they might have otherwise missed.

At the extreme, I've seen paths of backups of the production database listed in a publicly readable .gitignore, and that database backup was publicly accessible, too.

Most of the time, nothing sensitive is revealed, but defense in depth suggests it's better to not upload files like these to your web server unless they're being used by the webserver (like .htaccess) or crawlers (like robots.txt), and if you do, they ought to not be publicly readable (unless intended, like robots.txt), but even then, you'd want to make sure nothing sensitive is in any file like that which is publicly readable. Even if there's nothing sensitive in them now, there's no guarantee that nothing sensitive will ever be added.

oceanplexian• 4 years ago

I'm gonna give my counter take. Information disclosure is something that the DevSecOps(tm) crowd spends a disproportionate amount of time on for little benefit. The number of security professionals who don't know how to code, but learned Nessus or CrowdStrike and criticize others is too damn high.

I had to work with a security team in a FAANG for several years. They were so high and mighty with their low sev vulnerabilities, but they never improved security, and refused to acknowledge recommendations from the engineers working on systems that needed to be rearchitected due to a fundamental problems with networking, security boundaries, root of trust, etc. Unsurprisingly, their "automated scanner" failed to catch something a SRE would have spotted in 5 minutes, and the place got owned in a very public and humiliating way.

When I see things like this it brings back memories of that security culture. Frankly I think Infosec is deeply broken and gawking over a wild .gitignore is a perfect example of that.

kadoban3• 4 years ago

It's a bit of an information leak, but probably not a particularly serious one. It just gives some information about what tech stack they're using, which isn't really public but also not that hard to find out, and maybe a bit about where an attacker would want to look for other sensitive stuff. Pretty minor really, on its own.

It is a bit embarrassing because most web servers (and deployment setups) shouldn't be publishing/serving dot files anyway (files with names beginning with dot). But it's not necessarily a problem as long as they have some protection to avoid the _really_ sensitive stuff leaking, it's just kind of funny.

mlindner6• 4 years ago

It's not really leaky and can't be exploited by anyone. It's an interesting curiosity at best.

diogenesjunior2• 4 years ago

you could theoretically social engineer until you find something to exploit

ie, if the file said to ignore "/site/adminpasswords.txt" then you could go to /site/adminpasswords.txt and reveal admin passwords. this is obviously a simple eli5 explanation but i hope it helps

however, i doubt the tesla.com website is where they keep any important code that relates to actual tesla software like we would see used in cars. that would be like the army having their real code for their software/systems at goarmy.com lol

sschueller• 4 years ago

At least https://www.tesla.com/.git/config is not accessible but still. This should never happen to a company that considers itself a software company first and a car company second.

tomjakubowski2• 4 years ago

One place I worked for exposed .git on a PHP site to the world. Infra was ho-hum about the report until they got a PoC which cloned the repo.

newbieuser• 4 years ago

universal galactic extreme programming requires it

nr2x• 4 years ago

Good thing these are the people who helped fire Twitter's security team. Sure that's going to work out great.

revskill• 4 years ago

So, should we just add .gitignore to .gitignore and problem solved ?

alvis3• 4 years ago

No. You never checkout a site directly from git to begin with. You don't let other people know what files are ignored from git doesn't mean people cannot access them. :/

teknopaul2• 4 years ago

Nonsense.

Everyone uses git for source control, of course you check out a site with git.

All you are telling people with a .gitingore is what is _not_ available.

It means exactly that people can not access them if your site is a checkout, because they aren't there.

manojlds• 4 years ago

.gitignore to Dockerignore

(Partly joking)

kadoban3• 4 years ago

You're joking of course, but that likely won't do anything useful.

If it's tracked, then ignore has no effect. If it's not tracked, then you might as well use .git/info/excludes which is pretty much the same thing but not tracked, or you can use a global excludes file, like ~/.gitignore is common (you have to configure git to point at it, iirc).

It _could_ make sense to ignore the .gitignore if some other tool is parsing and using that file, but that pattern is...troublesome so I hope not.

vbezhenar• 4 years ago

~/.config/git/ignore

agumonkey• 4 years ago

the classic https://news.ycombinator.com/item?id=31420268

Git ignores .gitignore with .gitignore in .gitignore

alvis3• 4 years ago

There is a `cron.php` lol

MH15• 4 years ago

behind auth as of 4pm ET though

kalium-xyz• 4 years ago

My dear American friends. What if this is a psyop from tesla marketing to get your attention?

paulryanrogers• 4 years ago

Very well could be a honeypot. Though neglect and accretion is more likely

noncoml• 4 years ago

“Never attribute to malice that which can be adequately explained by stupidity”

Cyphase• 4 years ago

"Always design your malice to be adequately explainable as stupidity."

dopeboy• 4 years ago

Along with the acquisition of Twitter.

alvis3• 4 years ago

One of the best technology companies (let's assume it's) cannot maintain its site with modern technology. How can I trust them?

hutzlibu• 4 years ago

I do not trust Tesla because of the apparent instability of its owner, but not because its website does not use the most bleeding edge web technology. The website works and I see no information of any security flaws. This is what matters.

anecdotal1• 4 years ago

Does Elon personally drive every Tesla? Or do you think Tesla engineers will follow an insane directive knowing it would put peoples lives at risk and not push back or straight up walk off the job?

rbanffy8• 4 years ago

They build cars and batteries, not websites.

jahsome4• 4 years ago

Cars which are primarily controlled via software and interact with hundreds of web services.

outside1234• 4 years ago

“Hardcore Engineering”

x86x87• 4 years ago

all the engineers that have not modified at least 50 lines in the .gitignore file in the last 60 days have been not terminated

rsynnott4• 4 years ago

I mean, in fairness, if you're not getting enough rest (which seems to be what "hardcore engineering" means) then maybe you're more likely to screw up the nginx config.

mlindner6• 4 years ago

A web page isn't "hardcore engineering".

bri3d• 4 years ago

Not to defend the Twitter situation, which is foolhardy by almost any measure, but it's extremely uncommon for any company's main landing page to relate in any way to their software engineering team.

Usually these marketing sites are running a CMS (this one looks like Drupal) which is owned and operated by either an internal team who report to the CIO / IT department (vs the Product/Engineering group) or a totally external third-party marketing firm.

As long as the "real" product uses different subdomains, certificates, proper HSTS, cross-origin protection, and secure cookies (a tall order, yes, but something that would be an issue no matter what the marketing site is doing), security issues in the "marketing" site aren't as bad. Of course a marketing site takeover is still worrying, as it's a prime entry point for spearphishing and horizontal movement through social engineering, but these usually aren't the same engineers or security team at all.

cmeacham983• 4 years ago

Nobody (sane) is saying this is a security vulnerability or the like (especially as it seems to be a default Drupal gitignore). It's just a funny mistake from a "software first" company.

mlindner6• 4 years ago

There's several people in the comments saying exactly that kind of thing in this thread including people asking if it leads to vehicle code exploits.

shudza2• 4 years ago

So what is gonna be your opinion when it gets fixed?

SnowingXIV• 4 years ago

100%. Tacking on to this, the last few places I've been the public facing site was usually managed by the marketing or design team, and often was used as a project to get them to touch _some_ code. Engineering rarely ever got involved with this if ever. If not them; probably a third-party firm.

ackatz• 4 years ago

Getting 403 Forbidden now

tomjakubowski2• 4 years ago

Interesting, the exclude file (actually, everything under .git/info) 403s, while .git/index is a 404.

- https://www.tesla.com/.git/info/exclude

- https://www.tesla.com/.git/index

README.txt 403s too. https://www.tesla.com/README.txt

edit: just going to add files I've found here:

- https://www.tesla.com/.editorconfig

- https://www.tesla.com/profiles/README.txt

retrocryptid4• 4 years ago

sigh

retrocryptid4• 4 years ago

really? five down-votes because I sighed?

If you're going to down-vote me, down-vote me because I mentioned Elon is a human being, with human flaws and human strengths and not the resurrection of Supply-Side-Jesus.

TechTechTech• 4 years ago

https://cdn-design.tesla.com/.git/ this url says 'No.'

jahsome4• 4 years ago

Add a trailing slash to index and it 403s

bumblewax• 4 years ago

Two space tabs, nice.

Merlin04• 4 years ago

There's also https://www.tesla.com/phpunit.xml

v0idzer0• 4 years ago

It’s not leaky at all.

athesyn• 4 years ago

It's just their landing page, but still embarrassing nonetheless.

soheil2• 4 years ago

sites//settings.php

Yes PHP is still relevant!

dpcan• 4 years ago

Yeah. WordPress, Drupal, Joomla, Laravel, vanilla php. Together they power almost 45-50% of the web. So PHP is still extremely relevant. The most relevant you might be able to say.

soheil2• 4 years ago

I just don't understand why Apache dropped native php module support forcing everyone to deal with finicky cgi.

mlindner6• 4 years ago

I think a lot of people in here are overreacting a bit. This is an interesting curiosity that doesn't really have any baring on any of Tesla's internal software.

datalopers• 4 years ago

They've got something a bit more fucked up than just an exposed .gitignore

    $ curl -si https://www.tesla.com/ | grep generator
    x-generator: Drupal 9 (https://www.drupal.org)

    $ curl -si https://www.tesla.com/authorize.php | grep generator
    x-generator: Drupal 7 (http://drupal.org)

So they have at least two versions running at the same time. The /authorize.php [1] uri also yields a 500 (instead of a 403 like most of the other resources), which implies Apache is most likely passing the request off to PHP and the script has a fatal or unhandled error.

The webroot appears to be a Drupal 7.x installation and Apache is serving that content directly (e.g. https://www.tesla.com/MAINTAINERS.txt same as [2]) and trying to run some of it (authorize.php), while happy-path requests are being reverse-proxied to a Drupal 9.x installation.

[1] https://github.com/drupal/drupal/blob/7.x/authorize.php

[2] https://github.com/drupal/drupal/blob/7.x/MAINTAINERS.txt

ec109685• 4 years ago

They likely have layer 7 load balancing sending different paths to different servers.

diamondo25• 4 years ago

Guess Elon should go and reduce some Tesla services like he did with Twitter. Having different major versions of software running must take up a lot of maintenance...

frereubu• 4 years ago

"Support migration from existing Drupal 7 to the new Drupal 9 site"

https://www.tesla.com/careers/search/job/sr-software-enginee...

justinjlynn2• 4 years ago

polite chuckling

dhritzkiv2• 4 years ago

FWIW, a 500 doesn't imply the server is crashing. More likely just throwing a generic error, e.g. unexpected input –probably because it's expecting some form/data parameters– and failing the request early. It'd more correct to return a 400 in this case, but the /authorize.php endpoint may only be used by tesla.com frontend, so they don't care if it's used in unexpected ways.

anamexis• 4 years ago

What's the distinction between the server crashing and the server throwing an error?

deathanatos• 4 years ago

My knee-jerk reaction is that this looks like a marketing/eng split, or even just marketing/marketing. The main "corp" website of every org I've ever worked for is managed by marketing, not by engineering, and it usually shows in the quality. Usually drives someone in engineering (like me) slightly crazy, but honestly there are a million other larger fish driving me more crazy.

IME they're almost always completely separated from the "real" systems that engineers are working on / managing. A compromise wouldn't go far, in the backend. Something like XSS would be worse.

Always seems to come from some push to "running a website isn't our 'core focus' so we should vendor that" … or something. I've also encountered immense push-back on eng-managed corp websites: all those pesky best practices get in the way of just shoveling "content" (i.e., PR) out. And so it ends up separated from eng.

hackGAWDpremium• 4 years ago

Drupalgeddon 7 exploit. Infinitesimal chance it’s a vulnerable version. Unless we live in a sitcom simulation

ashirviskas• 4 years ago

So Tesla is free software: https://www.tesla.com/LICENSE.txt

gl-prod• 4 years ago

Drupal is.

sceadu• 4 years ago

Maybe that means they won't pull the same shenanigans that Mercedes did :)

elleven• 4 years ago

https://www.tesla.com/LICENSE.txt Tesla opensource confirmed?

dingosity• 4 years ago

The reason people think this is bad form is it indicates the site operators did something they did not need to do. It is an artifact of carelessness at best or misunderstanding of how their web server software works at worst. You do not need to serve a .gitignore file for a site to perform its basic function. But the obverse is also true. Serving .gitignore does not detract from the function of the site.

But among people who do this kind of thing for a living, there's a belief that every action you take (like copy a .gitignore file to the directory from which static files are served) should have an intent which can be traced to a specific requirement.

It's crazy to believe some product manager sat down and put "serve up a .gitignore file" in their PRD. Some people are therefore taking the existence of the .gitignore file in Tesla's public webspace to demonstrate a lack of care when it comes to matching requirements with behaviour.

But as people have pointed out, maybe this isn't a Tesla failing as much as it is a failing for one of their providers. And sure, on the list of failures, this is pretty minor. And if you can find a web host that ties behaviour to explicit requirements, I would LOVE to hear about it. Web hosting is a low margin business which doesn't pay premiums for detail oriented staff. To be sure, there are some AMAZING people working for web hosting outfits, but my point is they are working at web hosting firms in spite of their technical capabilities, not because of them.

To say Tesla is a crap-fest because they left a .gitignore in their public web-space is laughable. Tesla is a crap-fest because their stock is in the toilet, they often blow past promised delivery dates (cybertruck, anyone?) and are extracting cash from the rubes who believe "full self driving" means your car will drive itself in more than the most contrived of contexts.

Elon Musk is not an idiot because you can read a .gitignore from tesla.com. Having done business w/ Mr. Musk, I can assure you he is not an idiot. But he's also did not impress me as the super-genius many seem to make him out to be. He is not playing 4D chess. He's a reasonably intelligent guy who won the lottery (rich parents, older brother who cut him in for a percentage, met the right people just as the USG wanted to buy more launch capability and state and federal governments subsidizing electric cars.) If anything, he's uncanny in his ability to identify opportunity. Maybe that's even better than the Sili Valley execs whose skills extend to being white, pretty and GSB educated. (If you downvote me, please downvote me for the slight on the Haas School this last comment was intended to be.)

To recap... serving a .gitignore in your public web-space doesn't mean you're a dolt. It also means you're probably taking less care than you could. But maybe we don't need to take such care on a static web-site. But it does make me wistful for the days when competence was more obviously exhibited.

Elon Musk is considered a jerk because of his behaviour, not because someone in one of his companies left tesla.com/.gitignore in the public web-space. Tesla is not god's gift to American industry. It is a bit of a goose up the backside of entrenched incumbents, and for that I will always have a soft spot for it. Except for the bits where they seem to be a lightning rod for controversy which always seem to be unforced errors.

Good Day To You, Sir!

retrocryptid4• 4 years ago

John Steven has a quote I quite like: "QA is making sure your software does what it's supposed to. Security is making sure your software only does what it's supposed to."

I think this is the lens the OP wanted readers to view this post through.

sangnoir• 4 years ago

Elon Musk is not an idiot because you can read a .gitignore from tesla.com.

Now imagine what Elon would tweet if he discovered the same mistake on a Twitter subdomain.

kerryoco• 4 years ago

TIL "obverse", ty

fnordpiglet• 4 years ago

It’s ok. Elon code reviewed it.

kobalsky• 4 years ago

this isn't reddit

SV_BubbleTime3• 4 years ago

And it isn’t clever there.

Elon makes a bunch of moves and posts that all revolve around pruning the company. And it’s become “omg he wants code printed, he’s so stoopid!”.

If I was going to prune a company, I would do the exact same thing to immediately weed out the people that came (figuratively) empty handed. They know they’re done and it would save me the time.

Traubenfuchs• 4 years ago

It's rapidly becoming like it though. I don't know why, but the quality of comments is decreasing and more and more zero (see the comment you responded to) / negative value comments appear. The decline has become noticeable in the last ~half year.

Hormold• 4 years ago

Check this: https://cdn-design.tesla.com/tds-fonts/

Saved version:

TypeError: Cannot read property '0' of null

    at forceFontAssetSource (/app/routes/middleware/moduleVersion.js:89:32)
    at Layer.handle [as handle_request] (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:317:13)
    at /app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:284:7
    at Function.process_params (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:335:12)
    at next (/app/node_modules/@tesla/design-system-tools/node_modules/express/lib/router/index.js:275:10)
    at cors (/app/node_modules/cors/lib/index.js:188:7)
    at /app/node_modules/cors/lib/index.js:224:17
    at originCallback (/app/node_modules/cors/lib/index.js:214:15)
    at /app/node_modules/cors/lib/index.js:219:13

sassy_quat2• 4 years ago

Hilariously most people are unable to program in a secure fashion. https://www.zdnet.com/article/over-100000-github-repos-have-...

News about Tesla's security seems vaguely wanting, I do not know what this .gitignore file is about, but it is quite alarming enough to draw conclusions from.

sassy_quat2• 4 years ago

Edit: failed to provide context, most people should be left out of writing public interfaces for non-hard real time systems.

hankchinaski• 4 years ago

I like the simplicity and pragmatism of using drupal. I wouldn’t work with it myself but it was probably the cheapest/fastest way to get a similar site up and running

rbanffy8• 4 years ago

Indeed. I'd use Plone, but it's overkill for a website like this.

throwaway67342• 4 years ago

If you stick completely within the Drupal"standard path", it's a great way to get a site up and running. Once you step outside of that path it's an absolute misery

jpoesen2• 4 years ago

Dunking on a tech while using a throwaway account and not providing details on why you find it absolute misery... not very useful or trustworthy.

RobertWHurst• 4 years ago

You all are cringe. Anyone working in tech knows that most marketing sites are made by third parties, likely some WordPress shop. The hatred for Elon on this site is ridiculous.

misiti37803• 4 years ago

it's very weird. someone responded once that hacker news is a bunch of smart dorks that are basically jealous because they have not achieved anywhere near as much as elon has. i think there is some truth to this.

rbanffy8• 4 years ago

How many of us were born owning an emerald mine after all?

rvz• 4 years ago

Yes. It is indeed a strong indication that they are secretly very jealous and don't want to admit it.

Hence why they are commenting and screaming everyday at Elon, letting him reign in their minds rent free; which I find quite hilarious on this site, Twitter and elsewhere.

I'm just laughing at the entire chaos being covered 24/7, and especially laughing at the angry 'dorks' attempting to escape it all; which they are unable to.

qzx_pierri• 4 years ago

Yeah man it's wild. I think some people just need a "boogeyman" at all times to focus on, to help ignore their own faults. Elon is a bit of a bellend, but he's nowhere near the evil, cold blooded, psychopath that people on HN (and sites like The Verge) paint him out to be.

SV_BubbleTime3• 4 years ago

Make no mistake; This is a retribution attack in the culture wars.

This isn’t about Musk, and it’s not about Twitter-actual. It’s about Twitter-meaningful, which is to say a way since 2008 or so of controlling messages.

pvg• 4 years ago

Just flag bad posts. Meta-fuming only makes everything worse.

jamesy0ung• 4 years ago

Getting a 403 Forbidden error.

ericmcer• 4 years ago

A companies marketing website and their actual products have little in common. I would be surprised if any engineers even work on the marketing website and blown away if it is co-located with something sensitive.

FormerBandmate3• 4 years ago

https://xkcd.com/932/

Ffs, a tech forum should be better than this

wink• 4 years ago

No, it's a valid complaint - I've seen it at several companies that the development team were eager to present a professional website (so that anyone in the know looking would not find such embarrassing stuff and maybe scare off potential new hires or customers) but it ended up in the hands of the marketing department. To the degree that the infra was moved to a different domain so the wordpress install at "www.example.com" could never even remotely do anything with cookies at "example.net" - but yes, that might have been a tad paranoid ;)

I think the person you were replying to was not playing down the thing that happened, but explained exactly what the cartoon said. It not being important for the general public does mean it's not a probable fact.

ranman• 4 years ago

I would judge a vendor or consulting firm based on their marketing website. Why wouldn't I judge a car maker?

camel-cdr2• 4 years ago

It looks like https://www.tesla.com/INSTALL.txt & https://www.tesla.com/README.txt exist, but aren't accessible.

camel-cdr2• 4 years ago

https://www.tesla.com/MAINTAINERS.txt

SV_BubbleTime3• 4 years ago

The Venn diagram of people who had an issue with the Tesla website yesterday, and people laughing at it being Drupal today does not intersect.

adolph• 4 years ago

Potentially also of interest is robots.txt. Who knew Tesla had ontologists?

https://www.tesla.com/robots.txt

Disallow: /taxonomy/term/*

404: https://www.tesla.com/taxonomy/term/

unixhero• 4 years ago

Huh... php

lxe• 4 years ago

Some Tesla holiday on-call devops or security person is probably getting paged over this right now.

madmod• 4 years ago

I found a bug in the tesla model 3 reservation system that allowed anyone to get a reservation for free. Reported it via hackerone (or maybe it was bugcrowd dont remember) and got told it was of no consequence and would be filtered out later or something. Got no bounty for hours of work.

I accidentally ordered my model 3 with a free reservation, not the one I actually paid for.

jonathanyc• 4 years ago

Given that people are selling reservations for thousands of dollars, I think you deserved something for reporting the issue. But I suppose being a hardcore engineer means never having to say you're sorry.

KETpXDDzR• 4 years ago

Archived version: https://web.archive.org/web/20221126004310/https://www.tesla...

za3faran• 4 years ago

Seems they took it offline. Any mirrors?

Tesla.com/.gitignore

Related Stories