There are so many of these. It gets a little scary when it veers from professional security to individual personal privacy https://github.com/search?p=2&q=smtp.gmail.com+pass&ref=sear...
Wow, that is scary.
GitHub commit search: “remove password”
51–60 of 266 posts
Re: GitHub commit search: “remove password”
#52This is the main reason I use gitlab, because they have free private repos. When your trying to smash out code as fast as possible in a startup you don't want to have to worry about acccidently checking a secret in
Re: GitHub commit search: “remove password”
#53Computers are supposed to be good at what imperfect humans are not. This only proves how primitive the tool is.
That is, for example, if Gmail can ask "it looks like you forgot the attachment" why can't Git say "this is a public repo and you're about to commit and push passwords. Are you sure?"
It's going to be easier to fix the tool than it is to make humans be perfect.
Re: GitHub commit search: “remove password”
#54This is the main reason I use gitlab, because they have free private repos. When your trying to smash out code as fast as possible in a startup you don't want to have to worry about acccidently checking a secret in
Bitbucket is another alternative for free private repos.
Re: GitHub commit search: “remove password”
#55Computers are supposed to be good at what imperfect humans are not. This only proves how primitive the tool is. That is, for example, if Gmail can ask "it looks like you forgot the attachment" why can't Git say "this is a public repo and you're about to commit and push passwords. Are you sure?" It's going to be easier to fix the tool than it is to make humans be perfect.
I'd say that it's hard to implement this effectively. Maybe as a language / framework-specific hook.
Re: GitHub commit search: “remove password”
#56I'll raise you a handful more:
add password / add passwords
* https://github.com/search?utf8=%E2%9C%93&q=add+passwords&typ... * https://github.com/search?utf8=%E2%9C%93&q=add+password&type...
add secret / add secrets
* https://github.com/search?utf8=%E2%9C%93&q=add+secret&type=C... * https://github.com/search?utf8=%E2%9C%93&q=add+secrets&type=...
Re: GitHub commit search: “remove password”
#57Computers are supposed to be good at what imperfect humans are not. This only proves how primitive the tool is. That is, for example, if Gmail can ask "it looks like you forgot the attachment" why can't Git say "this is a public repo and you're about to commit and push passwords. Are you sure?" It's going to be easier to fix the tool than it is to make humans be perfect.
How would git know that it's a password/key/whatever?
Re: GitHub commit search: “remove password”
#58This is a good example of the increased risks from doing your development out in the open, any mistakes are exposed to a much wider group of potential adversaries. On an internal VCS, this would still be a problem, but a bit less visible/exploitable...
We've published internally developed projects on github after removing anything sensitive and initializing a new repo from the latest version of the code base.
You lose your development history, but you ensure you won't get bitten by stuff like this.
Re: GitHub commit search: “remove password”
#59Earlier quoted context omitted.
On an internal VCS this may be a deliberate decision: Secrets need to be stored somewhere and a cost-risk analysis can result in "this is the best place that we currently have at our disposal". That obviously won't fly if your threat model includes "adversary may attack our github account from within GH" or if you ever plan on opening up that repo, but if neither applies this may be the best place to store some sorts…
I've gone through the process of open-sourcing previously closed codebases, and in virtually all of them a decision is made to make a single "genesis" commit to start the public exposure because there's just not enough manpower (or I don't know git well enough) to go through and ensure there not only aren't any secrets now (meaning passwords, or info the company doesn't want to release), but also there weren't at any…
Genesis commit, that's a catchy name for it. We've done the same thing, after some discussion this always ends up making the most sense.
Also, you can hide your crimes and not show off all your "TODO: put more stuff here" commits to the world.
Re: GitHub commit search: “remove password”
#60Earlier quoted context omitted.
And this would be a cool feature from github too. A link mentioning "we found something in your code that looks like a secret, please know people will use it."
They do this for all of their own API keys already. They not only notify you but instantly invalidate a key pushed to a public repo. Annoyingly there is no way to turn it off even when you explicitly want to share an API key knowingly. But i'm more than fine with needing to "obfuscate" an API key or manage secrets correctly knowing it saves TONS of people.
Why would you ever want to share a valid Github API key publicly?