In case anyone else made this mistake, Github's help section has an article describing the steps needed to remove sensitive data from a git repo:
Tell HN: Github has dozens of public s3 passwords
11–20 of 31 posts
Re: Tell HN: Github has dozens of public s3 passwords
#12" What's the best way to warn these folks? What other credentials are lurking out there?" Sure, posting that on HN is a good way...
How about leaving them some README-NOW.txt file in their S3 bucket?
Re: Tell HN: Github has dozens of public s3 passwords
#13good reminder to us all, thanks Kabuks
Re: Tell HN: Github has dozens of public s3 passwords
#14Protip: keep settings in a separate file
Mark the file as excluded from svn/git.
Make a settings.sample file for the project.
Re: Tell HN: Github has dozens of public s3 passwords
#15Rather than store passwords or sensitive config data in a file I'll usually try to store them in an environment variable. Heroku has a little guide on this: http://docs.heroku.com/config-vars
Re: Tell HN: Github has dozens of public s3 passwords
#16Rather than store passwords or sensitive config data in a file I'll usually try to store them in an environment variable. Heroku has a little guide on this: http://docs.heroku.com/config-vars
I use a similar strategy: http://trevorturk.com/2009/06/25/config-vars-and-heroku/
...this kind of thing doesn't have to be Heroku-specific, though.
Re: Tell HN: Github has dozens of public s3 passwords
#17There is a business opportunity here. Managing credentials and secrets is (passwords, private certs, etc) is hard. Making that process turnkey, secure and easy would be useful.
Re: Tell HN: Github has dozens of public s3 passwords
#18There is a "message" button on each github user page.
I just sent this to a few people (including someone who had forked one of my projects and added their S3 keys to a config file):
Noticed you have your Amazon S3 keys out in the open on github. You might want to remove those config files from your repository as described in the thread here:
http://news.ycombinator.com/item?id=1574211
-Pete
Re: Tell HN: Github has dozens of public s3 passwords
#19In case anyone else made this mistake, Github's help section has an article describing the steps needed to remove sensitive data from a git repo: http://help.github.com/removing-sensitive-data/
In this case rotating your S3 creds is probably the optimal solution.
Re: Tell HN: Github has dozens of public s3 passwords
#20" What's the best way to warn these folks? What other credentials are lurking out there?" Sure, posting that on HN is a good way...
How about leaving them some README-NOW.txt file in their S3 bucket?
I rarely list the contents of my S3 buckets so I'd probably never notice this.
Send them a message on GitHub, perhaps?