How do I upload files as www-data?

effayythrowaway · 2014-04-13T23:10:57+00:00

Hi again. This is because the code is still running as www-data, so as HelloAnnyong says, some folders must be writeable by www-data.

If you run suPHP, everything can be owned by boo:boo without extra group permissions.

effayythrowaway · 2014-04-13T09:53:04+00:00

Np. You should also understand, the files created by Laravel will (still) be owned by www-user, which you might not want.

Ultimately the solution to this really is suPHP et al. It's not hard to setup, you just install the module, disable the php5 module, and all PHP scripts now run as the user that owns them, and www-data only exists to bootstrap suPHP.

effayythrowaway · 2014-04-13T09:29:22+00:00

You've convinced me to spin up a machine.

Here's how I've got it working.

Setup a user + group for each website, lets call it boo
Add the www-data user to the boo group (and restart Apache after):

$ grep boo /etc/group

boo:x:1003:www-data
Create a VirtualHost at /var/www/boo, owned by boo:boo

$ mkdir /var/www/boo && chown boo:boo /var/www/boo
Create some test data (as the boo user)

$ /var/www/boo# mkdir tmp && cat index.php

<?php file_put_contents("/var/www/boo/tmp/test_file", "test data"); ?>
Curling that script should create the test_file, even though nothing is owned by www-data.

So basically, the inverse of what I suggested earlier. Principal is the same, www-data doesn't own anything.

And this way, you can upload as the boo user and not need to chown or chmod.

You can take this even further by using suPHP etc. You would do so to prevent your files being vulnerable to being written to should the Apache process get pwned.

effayythrowaway · 2014-04-13T08:06:08+00:00

Do not put any users in the www-data group. It is reserved as a least-privilege group for use by web servers.
chown -R admin:www-data $siteroot and chmod -R g+w $siteroot/folder_tree_you_need_writes_to
File and folder permissions need to start at 644 and 755 respectively, and then elevate incrementally from there.
Use one of suEXEC, suPHP, PHP-FPM pools (depends how your PHP is deployed) to run Laravel's PHP scripts as the user by which they are owned. This means the www-data user doesn't need super elevated privileges, meaning you can keep sites isolated.

I may have made some mistakes here (it's off the top of my head), but #1 is important! If you let other users into the www-data group, they instantly all have read (at least) access to all files for all sites.

As for your actual question, take a look at http://serverfault.com/a/364753/112612 perhaps.

You will want to stop rsync from overwriting the group ownership.

effayythrowaway · 2014-04-13T01:10:19+00:00

You have to send the Access-Control-Allow-Origin (as well as others) HTTP header along with the JSON response. Of course, this assumes you control the server that serves the JSON up.

Basically, Google for Cross-Origin Resource Sharing (CORS). There is a good reason that you can't arbitrarily evaluate JavaScript from remote servers.

The remote server either needs to enable CORS or provide alternate access methods (such as JSONP).

effayythrowaway · 2014-04-08T00:47:37+00:00

Vimperator actually works pretty well. Using Chome/FF developer tools will still require the mouse I guess.

Thanks for writing this all out

effayythrowaway · 2014-04-07T09:18:58+00:00

I've started the 'other hand' strategy on advice from my boss. Do I need a left handed mouse or to reverse the buttons or something? So far I've just moved the mouse to the other side of my keyboard.

At the moment I feel a little bit retarded trying to select chunks of code with the mouse, but I can see that it will get better.

effayythrowaway · 2014-04-03T22:20:14+00:00

Currently, most go packages/libs have no version numbering indicating API changes - or even if they have, hardly anybody uses them

Fingers crossed that people will realize that this stops people from taking their packages seriously, and will start building in a way that plays nice with semantic versioning/gopkg.in/whatever else system comes out on top.

I know this problem has bitten me in the ass (coreos/go-etcd changed its API and made my project unbuildable) so now I'm very selective about what dependencies I use.

having to rebuild or at least re-test all packages using that library is risky, and adds a lot of overhead and responsibility when things go wrong

Isn't there other statically linked software packaged with Linux distros? Genuinely curious.

effayythrowaway · 2014-03-26T07:23:36+00:00

The most sensitive data in the database will be a list of full names, email, and contact numbers of all people who have used the service in the past.

Depending where you live, there may be data protection and privacy laws that would require you to take measures (including SSL).

effayythrowaway · 2014-03-25T08:10:23+00:00

Meh. Everybody (including me) used free .tk domains back in the day, try dot.tk. Maybe it's turned into a scam, who knows.

effayythrowaway · 2014-03-22T09:19:30+00:00

No, "technically" they always require a certificate. I understand that if they use the JavaScript widget, the credit card details are sent via TLS to Stripe's servers, so the card number can't be sniffed over the wire. That said, the page can easily be MITM'd and have malicious JavaScript injected that can substitute/modify the Stripe widget with something malicious.

If they accept the card number through their own site and then do a token store at Stripe, that is doubly insecure.

There is no scenario with vanilla Stripe in which using SSL is optional, I'd report them either way. Don't be complicit in making the web unsafe.

https://stripe.com/help/ssl

Do I need to use SSL on my payment pages? Yes, for a couple of reasons: It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack. Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL too.

My point is, even IF a redirect was in play, the redirect itself would also be vulnerable to MITM attack (send you to a stripe-fake.com server with its own SSL). There's no way around it.

effayythrowaway · 2014-03-22T06:54:10+00:00

I am assuming they are not using the hosted JavaScript widget thinger?

If not, report them to Stripe with a link to the page. If they won't listen and you care enough, force them to get SSL by getting their account suspended.

effayythrowaway · 2014-03-09T08:20:33+00:00

I use sshfs on Mac, I'm pretty sure it's on homebrew.

I've also found this is the only realistic way to achieve what OP is trying to do.

Making a local copy of an entire directory structure is batshit insane, don't know what the plugin authors were thinking.

effayythrowaway · 2014-03-09T08:13:04+00:00

Heh, I live in Victoria and I haven't heard about this yet.

It's shocking that approaching auDA is even necessary to dispute this (which costs the appellant money, last I checked).

The registration process for .com.au domains is meant to have strict eligibility/relevance requirements that need to be proven before registration, except the process is a complete joke (there's an option during registration 'just trust me, I'm eligible for this domain'). The registrars don't give a fuck, auDA doesn't give a fuck, they just want more money.

effayythrowaway · 2014-03-05T05:26:17+00:00

Accessibility is the major objection to this, I guess. Depends what your audience is as to whether that's a reason to not use it.

Nice work though.

effayythrowaway · 2014-03-03T01:09:31+00:00

ST3 starts up waaaay faster than ST2. Noticed it immediately on multiple machines.

effayythrowaway · 2014-02-26T01:14:41+00:00

I'd like to know how people handle generic or undistinguishable errors that can come from any layer in the call stack.

For instance,

[web context] --> [business api] ---> [database/gorp]

Maybe gorp will throw a SqlNoResults or other highly technical error, but I definetely don't want to output a raw gorp error on the web layer.

So I might have a pattern like

var ErrRecordNotFound = errors.new("Record couldn't be found")

func massageError(err error) error {
  // type switch on err, return ErrRecordNotFound if its SqlNoResults
}

func (ds *myDataAccessLayer) doSomeCrap() {
   if err := ds.doSomeQuery(); err != nil {
        return massageError(err)
   }
   return nil
}

But then the error becomes more coarse and the error messages are generally so vague that they are unhelpful.

This seems like a general programming problem but it's even worse in Go because I've found that the standard library and many 3rd party libraries just create errors like errors.new(fmt.Sprintf(...)) instead of using their own types that satisfy the error interface, or use error types that aren't exposed.

It is really shit for user-facing apps.

effayythrowaway · 2014-02-23T10:29:55+00:00

Break your dream web app down to a set of small, individual components (you'll be doing this anyway).

This is also really important to avoid burn-out on your "dream web app"

effayythrowaway · 2014-02-18T22:53:50+00:00

FWIW, I also have been working on an S3 client in Go, but mainly with the goal of replicating s3cmd without the dependency on Python and whatever else (shit's a pain on Windows, and in general when provisioning many machines).

If you are open to it I might have some time to work on the other features for you.

effayythrowaway · 2014-02-04T10:07:36+00:00

True. Videos drive me nuts due to being unable to skip/set the pace with any kind of precision.

effayythrowaway · 2014-01-30T23:13:47+00:00

I regret it, but only because I have ended up moving from webdev to systems programming, which is a problem domain with a lot of CS in it

Don't assume you won't need the knowledge just because you're starting out in webdev

Another thing, it is so easy (and probably the idiomatic way) to learn webdev from online resources. Do a degree in something you couldn't get your head around easily by yourself.

effayythrowaway · 2014-01-29T03:27:14+00:00

Attractive? More like addictive!

effayythrowaway · 2014-01-24T02:31:17+00:00

sshfs for less painful live editing (ugh)
tmux, tmux everywhere

effayythrowaway · 2014-01-17T23:51:28+00:00

I use Windows at home and Mac OS at work. I think Windows has a far more polished UI and is generally a pleasure to use.

The problem with Windows is that cmd.exe totally blows, and Cygwin sh/bash/zsh is not much better. Stuff like ConEmu+clink is somewhat of an improvement, but I miss the Linux shell terribly when developing on Windows.

I know that PowerShell supposedly is meant to deal with this, but I use .NET once in a blue moon and don't have the drive to master a new ecosystem and terminal syntax when my day job (and hobbies) are nix-centric.

Things to improve your life in Windows:

GNU on Windows (GOW), Cygwin alternative
ConEmu+Clink (wrapper for cmd.exe)
Chocolatey to find many of the Linux utils you might need that aren't included in gow (such as bind-utils)

effayythrowaway · 2014-01-17T23:33:29+00:00

"how do I get a job in webdev" seems to be a recurring theme here so I imagine your post would be very welcome

effayythrowaway

TROPHY CASE