Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitLeaks – Search engine for exposed secrets on GitHub

gitleaks.com

Post reply on HN
Print view View original

11–20 of 63 posts

Re: GitLeaks – Search engine for exposed secrets on GitHub

#11

Post by the_duke »

lrusnac wrote: post #9
sarreph wrote: post #7

What a shame that you had to expose everyone's mistakes like this in such a blanket fashion. You could've taken the moral high ground and created a reverse-search such as HaveIBeenPwned[0], whereby you check repos you own. I hope this gets taken down because the potential for abuse is ripe. [0] - https://haveibeenpwned.com

that's such a great idea, although I think people that would sign up for this service would know not commit credentials

Well, the service could auto-create an issues for each repository that contains secrets.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#12

Post by [deleted] »

flipp3r wrote: post #4

I guess that's one way to get attention to your business. Instead of informing the owners of repositories by creating an issue, you create a search engine to expose them, and then ask to be paid for usage of this index? The only reason someone would want those secrets is to abuse them. This is basically the only use case for the data. Why do this? This is coming from "fallible.co" whose homepage says "Prevented 40 mi…

[deleted]

Re: GitLeaks – Search engine for exposed secrets on GitHub

#13

Post by Xylakant »

lrusnac wrote: post #9
sarreph wrote: post #7

What a shame that you had to expose everyone's mistakes like this in such a blanket fashion. You could've taken the moral high ground and created a reverse-search such as HaveIBeenPwned[0], whereby you check repos you own. I hope this gets taken down because the potential for abuse is ripe. [0] - https://haveibeenpwned.com

that's such a great idea, although I think people that would sign up for this service would know not commit credentials

We all make mistakes despite better knowledge. I'd probably sign up.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#14

Post by koolba »

nitza wrote: post #5

Why not use your knowledge of these exposed secrets for good? You know which repo they're coming from, it'd be super simple to let the owner know rather than potentially costing them time and money. It also seems as though the only use of this site is to capitalise on other people's mistakes? It looks like you're just handing over leaked data to people who will definitely abuse it, which seems to go against your core…

Would it be considered spamming to pull the email address of the commits and send them an automated email?

Re: GitLeaks – Search engine for exposed secrets on GitHub

#15

Post by lrusnac »

the_duke wrote: post #11
lrusnac wrote: post #9

Earlier quoted context omitted.

that's such a great idea, although I think people that would sign up for this service would know not commit credentials

Well, the service could auto-create an issues for each repository that contains secrets.

well, that's kinda the same, facilitating finding the secrets since it's easy to search for issues, feel like a private notification is way better

Re: GitLeaks – Search engine for exposed secrets on GitHub

#16

Post by nitza »

koolba wrote: post #14
nitza wrote: post #5

Why not use your knowledge of these exposed secrets for good? You know which repo they're coming from, it'd be super simple to let the owner know rather than potentially costing them time and money. It also seems as though the only use of this site is to capitalise on other people's mistakes? It looks like you're just handing over leaked data to people who will definitely abuse it, which seems to go against your core…

Would it be considered spamming to pull the email address of the commits and send them an automated email?

Well, you don't need to send an email necessarily, a GitHub issue with a guide on how to include sensitive data in a public repo would probably suffice.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#17

Post by lrusnac »

Xylakant wrote: post #13
lrusnac wrote: post #9

Earlier quoted context omitted.

that's such a great idea, although I think people that would sign up for this service would know not commit credentials

We all make mistakes despite better knowledge. I'd probably sign up.

sure, but it's more likely for somebody that doesn't know about this service to publish a secret than someone that is aware of it

Re: GitLeaks – Search engine for exposed secrets on GitHub

#19

Post by tokenizerrr »

lrusnac wrote: post #8
nitza wrote: post #5

Why not use your knowledge of these exposed secrets for good? You know which repo they're coming from, it'd be super simple to let the owner know rather than potentially costing them time and money. It also seems as though the only use of this site is to capitalise on other people's mistakes? It looks like you're just handing over leaked data to people who will definitely abuse it, which seems to go against your core…

I agree with what you wrote. My two cents are: seems that getting attention goes against being nice to others, such a shame living in such a society.

Yet if people don't know the risk exists, they'll continue being ignorant and fucking up. Awareness is a good thing.

Re: GitLeaks – Search engine for exposed secrets on GitHub

#20

Post by nitza »

tokenizerrr wrote: post #19
lrusnac wrote: post #8

Earlier quoted context omitted.

I agree with what you wrote. My two cents are: seems that getting attention goes against being nice to others, such a shame living in such a society.

Yet if people don't know the risk exists, they'll continue being ignorant and fucking up. Awareness is a good thing.

This isn't awareness though. This is like telling a specific set of people about all the houses near by that have their front door key under the mat. You only become aware of the issue when it is too late.
Post reply on HN