Earlier quoted context omitted.
Some of these commits are PGP signed...
What do you mean by that? That people took the trouble to use PGP but then go and do something this silly?
Yes.
GitHub commit search: “remove password”
191–200 of 266 posts
Re: GitHub commit search: “remove password”
#192For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it. https://rtyley.github.io/bfg-repo-cleaner/
Sounds like a better idea to just change the secret.
But then what do you do when you accidentally commit someone's private medical records or get a "right to be forgotten" order?
Edit: I had similar objections to "why not rework databases as an immutable diff history?" https://news.ycombinator.com/item?id=13581096
Re: GitHub commit search: “remove password”
#193Right after my "remove secrets" post: https://news.ycombinator.com/item?id=13650614 There are just so many of those it's crazy: remove .env YOURFAVORITEAPI_SECRETKEY YOURFAVORITEAPI_PASSWORD Also replace "remove" with delete/rm/replace/etc. And replace "YOURFAVORITEAPI" with CircleCI, Travis, Mailchimp, Trello, Stripe, etc, etc. Also, companies I contacted consider it the customer fault and basically don't care.
I once pushed my Amazon S3 key to GitHub accidentally. Realized instantly what I'd done, and while in the process of feverishly regenerating a new key, my cell phone rings. It's Amazon telling me I pushed my S3 key to GH.
You pushed your secret key, and they recognised it?
Does that imply that they are not hashing secret keys, or did you also push the account key (allowing for a single auth test on their side)?
Re: GitHub commit search: “remove password”
#194There are so many of these. It gets a little scary when it veers from professional security to individual personal privacy https://github.com/search?p=2&q=smtp.gmail.com+pass&ref=sear...
META
I notice in many instances Github showing an error.
We could not perform this search: Must include at least one user, organization, or repository
But if you change anything in the URL, it works again. Such as adding &p=2, which lucideer tried. But I got the error on his link. So I changed it to p=3, and it worked.
So I'm guessing Github has an autodetection for a particular global code search getting high hits (for something like this, I assume) that locks people out.
Seems more like a band-aid on a broken leg, though.
Re: GitHub commit search: “remove password”
#195Earlier quoted context omitted.
I once pushed my Amazon S3 key to GitHub accidentally. Realized instantly what I'd done, and while in the process of feverishly regenerating a new key, my cell phone rings. It's Amazon telling me I pushed my S3 key to GH.
You pushed your secret key, and they recognised it? Does that imply that they are not hashing secret keys, or did you also push the account key (allowing for a single auth test on their side)?
The secret key can probably be used to generate the account key.
Re: GitHub commit search: “remove password”
#196Earlier quoted context omitted.
Doesn't that requires a force push? Force pushes are acceptable for private repositories with a single user, but typically not in larger projects. Just revoke the password/secret/whatever.
I find force pushes acceptable for topic branches of public repos. In fact, I use them a lot to leave behind clean history. Same as with squash merges, which technically also lose history.
It's better to push a similar name and let people decide if and when to rebase --onto the new upstream.
Squash merges are just bad. They destroy all the info that makes git handle branching and conflicts better than svn.
Re: GitHub commit search: “remove password”
#197[deleted]
Re: GitHub commit search: “remove password”
#198Earlier quoted context omitted.
Agreed that you absolutely cannot store sensitive passwords in your source code repo. Your proposed solution, however, has its own share of problems for some deployment scenarios. Where do you get this file from? Assuming you are meant to place it by hand each time you deploy your application... what about autoscaling? What if you want unattended deployment of apps?
There are lots of ways to handle those scenarios. Deciding where to store your secrets is extra easy if you're in the cloud. In AWS you can use KMS to store it if it's 4kb or less. A cli command or API call can decrypt it for you. If it's larger, you can use a tool such as credstash which lets KMS manage the keys. If you're in an environment that's using Chef, it can handle them. Ansible has a solution as well. Or yo…
Kms doesn't have a size limit if used right. You should use kms to store a key and store the data on s3 encrypted.
Re: GitHub commit search: “remove password”
#199Re: GitHub commit search: “remove password”
#200some random guy spammed a ton of commits with a bitcoin address saying "please send me money"
jesus christ, how low can you stoop