21–30 of 90 posts
150,000,000+ database passwords, of which 99.9999%+ are from local development servers.
I agree with mahouse and of course are some of these password legit. But this is nothing new, don't store sensitive data in git. Everyone know you can search this stuff on GitHub and if we look back - Google was a nice password search engine too (and still today)
Which is why I don't use any database password if the database is listening on localhost only, which is the case most of the time.
150,000,000+ database passwords, of which 99.9999%+ are from local development servers.
https://github.com/search?utf8=%E2%9C%93&q=filename%3Asettin...
I feel like people don't accept the fact that people do stupid stuff in other languages.
150,000,000+ database passwords, of which 99.9999%+ are from local development servers.
Excluding localhost and some obvious cases where the values are in a local config file still leaves around 111,000: https://github.com/search?p=1&q=filename%3Awp-config.php+DB_...
https://github.com/search?utf8=%E2%9C%93&q=filename%3Aweb.co...
Which is why I don't use any database password if the database is listening on localhost only, which is the case most of the time.
I don't think this is a good idea, even if the database is just listening to localhost. Say a malicious script gets uploaded to the machine, it will be able to dump the entire database without any need to seek out credentials.
Earlier quoted context omitted.
I agree with mahouse and of course are some of these password legit. But this is nothing new, don't store sensitive data in git. Everyone know you can search this stuff on GitHub and if we look back - Google was a nice password search engine too (and still today)
Don't store sensitive data in git, or don't store sensitive data on public github repos?
Store credentials in environment variables.