Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 2 down vote favorite

Recently I have project in which a directory listing is enabled, due to which some scripts can be seen by outside world. I asked website administrator and he said it's not his responsibility, its the programmer's job. I also asked programmer about this and he said that the script is actually a cron job, and according to him, he has to test the script on webserver as there is a difference between development and production environment, so he placed there to test that. According to him, there was no direct link as he assumed directory listing is disabled and taken care by administrator.

Who is the right person to do this?

share|improve this question
1  
Users are the root of all evil, only if you give them permissions. – JeffO Mar 14 '12 at 13:47
2  
When your webserver is hacked your web admin and everyone else are going to have a lot more work to do than fixing one permission issue. Go get one of the many web server vulnerability scanners and run a scan. Use the report as a starting point for a serious security discussion. – james Mar 14 '12 at 14:00
is that an instance of the "it's not my job" mentality, or just a bad case of "we are both so completely clueless about our craft, we'd better play distraction tactics and start arguing"? – ZJR Mar 14 '12 at 19:35

10 Answers

up vote 26 down vote accepted

It's duty and responsibility of both

The basic problems with security tend to have something to do with comfort and overconfidence (e.g. security through obscurity). If you know a way to cover a security hole, do it, there's no such thing as "too much security".

...it's not that hard

For example, the Joomla! project team places an empty index.html file on each directory to prevent directory listing and frameworks like Symfony and Ruby on Rails have a single public directory to which you must link on the public end of the server account.

Never ever be lazy when it comes to security

share|improve this answer
17  
+1. If everyone were doing only those things that are strictly their responsibility, nothing would ever get done. – Joonas Pulakka Mar 14 '12 at 7:02
2  
and if httpd directory index have only "index.php index.htm" should programmers create all possible files to avoid listing? Or in htaccess? – Dainius Mar 14 '12 at 8:56
3  
In my mind, no webservers should have directory listing enabled unless you explicitly allow it. It should NEVER be the default on any setup. – CaffGeek Mar 14 '12 at 14:22
up vote 3 down vote

It depends on your organization's security policies. At some companies, usually smaller ones, I had to do everything. At others, I wasn't even allowed access to the production web servers and the admins had to install my apps and do all the server configuration, sometimes while I looked over their shoulder to make sure everything is done correctly.

Basically, if your employer says it's your duty, it's your duty. Likewise, if they say developers can't access the production boxes, it's not your duty beyond making sure the admin knows what to do.

share|improve this answer
up vote 1 down vote

It's the programmers duty to fix anything that affects their application. If directory listing is a security concern for your application, then take steps for correct that. Good applications must not rely too much on the reliability of administrators.

share|improve this answer
if server administrator will copy directories with 666 permission will it be programmers work to set it to proper? Security is work for all, not only programmers or only admins. It's enough to have hole in one place to fail and all who works on that application should feel responsible for that. – Dainius Mar 14 '12 at 10:18
1  
@Dainius I'm not arguing against a joint effort, I'm simply pointing out that the bulk of the burden is on the programmer to be beware of simpleton administrators, and take the necessary steps to protect their applications. – Baker Kawesa Mar 14 '12 at 10:29
"programmers duty to fix anything that affects their application" programmer can't fix everything that affects their program. File listing is configurable in server config file, so who responsible for this, should do that. But for example sql injections is independent from server configuration so this is programmer work. – Dainius Mar 14 '12 at 10:50
@Dainius By "fix" I don't necessary mean setting permissions or modifying the server configuration autonomously, since that in itself would pose a security threat. But an application should know it's system requirements, and should to the greatest degree possible confirm that they are met before assuming any normal operations. If something bad is detected, it should nag the administrator about it, who should then proceed to fix it. – Baker Kawesa Mar 14 '12 at 11:18
up vote 1 down vote

If it can be done programmatically, then it should be written into the app by the programmer.

If it has to be done through an administrative process, and you have an 'administrator', then the administrator should do it.

Either way, the two roles should be complementary, not adversarial.

share|improve this answer
up vote 1 down vote

Simply, it is a programmer's job. Can a programmer upload his application with no security & testing, then sit back for a system admin to add Security for him? Certainly not. A professional programmer won't do this. A professional programmer will take the responsibility of making his/her code secure.

share|improve this answer
2  
The same could be said of a professional sys admin. Why would he sit back and wait for someone else to secure the boxes he is responsible for? – stonemetal Mar 15 '12 at 14:34
@stonemetal The sys admin secures the box much like perimeter patrol guards a VIP's house, while the programmer secures the app everywhere much like a bullet catcher guards a VIP. Ultimately, if an app "catches a bullet", it's the programmer who's has done most of the failing, a sys admin can't be expected to know exactly what degree of security an app needs to function, since their duty is to the box. Some apps find directory listing useful, while others are threatened by it. It's the programmers duty to have it turned off (by nagging the sys admin if that's the only way). – Baker Kawesa Mar 16 '12 at 0:39
up vote 0 down vote

You tried to resolve it yourselves, but here is an impasse. The person in charge needs to: step in, make a decision, and enforce the decision.

There should have been some specification that this was needed or not needed (This may be based on the person in charge's decision). This is a good candidate to put on a website security checklist. The admin should know whether or not this is set correct.

Good catch by the programmer. Keep up the fight.

share|improve this answer
up vote 0 down vote

I've dealt with similar situations before. Here's what you do:

  1. Call a meeting. Invite everyone possibly involved, including a manager.
  2. Run the meeting: Lay out the situation for everyone, and suggest a couple of possible solutions.
  3. Make sure that SOMEONE commits to solving the problem during the meeting.
  4. Email notes after the meeting to all attendees reminding them who will be fixing the problem.
share|improve this answer
...as soon as the manager grasps the situation, (if he can) this is gonna get pretty medieval for everyone involved – ZJR Mar 14 '12 at 19:46
@ZJR: What does medieval mean in that context? – Malice Mar 15 '12 at 16:17
@Malice I can only assume it is a reference to /Pulp Fiction/ – Vatine Mar 15 '12 at 17:41
I'm serious, though; when people are playing hot potato with a problem, you should get them all together to discuss it as a group. – Stephen Gross Mar 15 '12 at 18:38
up vote 0 down vote

It's programmer duty to protect his code and application, if he has the control to upload code and able to use htaccess then why not use index there. Often cpanel and other web servers has directory indexes enabled, no good programmer can leave important docs, zips and scripts in document root.

share|improve this answer
up vote -1 down vote

Both. It is a problem that has to be solved. If the programmer can do it, why not do it? If the admin can do it, why not do it? If the programmer cannot, it's obviously the responsibility of the admin, but the requirement should (probably) have been documented in the release docs.

share|improve this answer
As always with down-votes, it's probably a good idea to leave a comment saying why you're down-voting an answer. It is, to me at least, no obvious reason to down-vote this (apart from possibly being on the brief side). – Vatine Mar 18 '12 at 9:10
up vote -2 down vote

If it is inside the application, it is programmers responsibility

If it is outside the application, it is admin responsibility

share|improve this answer
...and now let's all enroll in a philosophy degree, so that, in 2 to 3 years, we can split hairs about the real boundaries of this elusive myth called "web application". – ZJR Mar 14 '12 at 19:37
Application = folder where you website is sitting. I assume there can be a number of sub domains pointing to different locations (multiple applications). Each may be programmed by different developers. Even one domain can be maintained by number of developers. The policies should come down from the IT Lead/Manager/Project Manager though. It's who job it is to implement it. – Noname Mar 14 '12 at 20:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.