31–40 of 266 posts
If you found a similar mistake in your repository, you can delete commit from history using: `git rebase --onto ^ `. Or if you want actually rewrite it, see git rebase -i` documentation.
Doesn't that requires a force push? Force pushes are acceptable for private repositories with a single user, but typically not in larger projects. Just revoke the password/secret/whatever.
How do you guys, handle this problem? I use either `git-crypt` [1] or `ansible-vault` [2]. 1: https://github.com/AGWA/git-crypt 2: http://docs.ansible.com/ansible/playbooks_vault.html
If you found a similar mistake in your repository, you can delete commit from history using: `git rebase --onto ^ `. Or if you want actually rewrite it, see git rebase -i` documentation.
Right after my "remove secrets" post: https://news.ycombinator.com/item?id=13650614 There are just so many of those it's crazy: remove .env YOURFAVORITEAPI_SECRETKEY YOURFAVORITEAPI_PASSWORD Also replace "remove" with delete/rm/replace/etc. And replace "YOURFAVORITEAPI" with CircleCI, Travis, Mailchimp, Trello, Stripe, etc, etc. Also, companies I contacted consider it the customer fault and basically don't care.
It is customer fault. However it should be pretty easy for them to set up a script to search github for this kind of stuff and automatically invalidate keys
Github, like SSH, uses an asymmetric authentication scheme. They even publish everyone's public keys. It's much more secure than passwords.
This is a good example of the increased risks from doing your development out in the open, any mistakes are exposed to a much wider group of potential adversaries. On an internal VCS, this would still be a problem, but a bit less visible/exploitable...
If you found a similar mistake in your repository, you can delete commit from history using: `git rebase --onto ^ `. Or if you want actually rewrite it, see git rebase -i` documentation.
Doesn't that requires a force push? Force pushes are acceptable for private repositories with a single user, but typically not in larger projects. Just revoke the password/secret/whatever.
This is a good example of the increased risks from doing your development out in the open, any mistakes are exposed to a much wider group of potential adversaries. On an internal VCS, this would still be a problem, but a bit less visible/exploitable...
Earlier quoted context omitted.
Doesn't that requires a force push? Force pushes are acceptable for private repositories with a single user, but typically not in larger projects. Just revoke the password/secret/whatever.
Or do both? Better safe than sorry.
If you found a similar mistake in your repository, you can delete commit from history using: `git rebase --onto ^ `. Or if you want actually rewrite it, see git rebase -i` documentation.