41–50 of 50 posts
* Why a separate service and not a pre-commit hook? * If a third-party has seen the key, hasn't the damage already been done?
http://pre-commit.com/hooks.html calling attention to detect-private-key and detect-aws-credentials (disclaimer-ish: was original contributor on the latter hook but been way expanded since then) edit: obviously each dev needs to have this set up, not a catch-all third party tool.
* Why a separate service and not a pre-commit hook? * If a third-party has seen the key, hasn't the damage already been done?
Because it's harder to enforce on a team whereas a central service (also as a 2nd security layer) deals with it on behalf of the team/org
>(also as a 2nd security layer)
Except when it's not.[1] That means it gives careless folks a false sense of security, which I think conveys more risk than no security at all.
* Why a separate service and not a pre-commit hook? * If a third-party has seen the key, hasn't the damage already been done?
"Scan 58f90084fa38b600114b33ea succerssfully started."
Also the "Profile" and "settings" links don't go anywhere.
Earlier quoted context omitted.
Agreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.
There are git hooks that u can run locally, but think as a manager of an R&D team of 10-20 developers. You need to make it centralised.
Whether you realize it or not, you're advocating for increasing surface area and risk. You're offering a service to people with bad opsec while simultaneously asking them to trust your opsec; none of which is a good solution to the actual problem.
http://pre-commit.com/hooks.html calling attention to detect-private-key and detect-aws-credentials (disclaimer-ish: was original contributor on the latter hook but been way expanded since then) edit: obviously each dev needs to have this set up, not a catch-all third party tool.
Have an example hook I can test out? Thanks!
Why should I trust you guys? I also recognize standard templates from miles away. EDIT: found the template http://demo.templateocean.com/premium/template/landx/layout-...
Hilarious. No customization at all!
Pro-tip: use `git add -p`
How about this one? https://github.com/dxa4481/truffleHog Posted here a few months ago.