Earlier quoted context omitted.
Speaking as an Asian American, no, let's not do that.
Ok; could you suggest an alternate? Would be handy to have a shorthand to refer to the incident
not their job. How about you come up with something catchy?
Billion-record stolen Chinese database for sale on breach forum
241–250 of 258 posts
Re: Billion-record stolen Chinese database for sale on breach forum
#242Earlier quoted context omitted.
Plenty of Chinese ones in subs like /r/China_irl etc., not seeing much traction of this story/dataset in Western world, though (hell, even on HN it barely got any upvotes 2 days ago.)
Had a look around on china_irl and couldn't find it, a link would be appreciated!
https://www.reddit.com/r/China_irl/comments/vqkfyt/
https://www.reddit.com/r/China_irl/comments/vr214w/
https://www.reddit.com/r/China_irl/comments/vr2lij/
https://www.reddit.com/r/China_irl/comments/vqfwic/
Take these threads with giant grain of salt though, they're far from thorough and some of them lack basic understanding of statistics. And I personally don't think the dataset (at least the sample) is actually random so not really a good representation of China's demographics.
Re: Billion-record stolen Chinese database for sale on breach forum
#243Earlier quoted context omitted.
hardcoded creds in example documentation... T_T Use vault, env vars, GitHub/GitLab secrets, anything but string literals!!!
Vault is not just a drop in and go system - setting up a vault instance is an ordeal in and of itself, and the pricing for vault on hashicorp cloud is incredibly expensive. The problem with the other options is that you have to get the secrets into environment variables, or out of github/lab secrets and into your application. To use most of the services like AWS secrets manager, vault, etc, it will cost you more to m…
Self-hosted Vault within a minimum Kubernetes cluster in GCP costs us roughly $35 a month. Maintenance effort can be neglected if not scaling. Vault has its learning curve there but I think it's totally worth it, given its secret management and API-first features integrated with many other DevOps tools.
Re: Billion-record stolen Chinese database for sale on breach forum
#244Earlier quoted context omitted.
Assuming this unverified version of the story is true, the danger of accidentally leaking credentials in code is enormous and one of the reasons I continue to maintain and develop gitleaks. Those credentials[1] would have been caught by the gitleaks' generic rule [2] [1] https://regex101.com/r/CLg9TK/1 [2] https://github.com/zricethezav/gitleaks/blob/master/config/g...
Fantastic tool. We all know that _we_ wouldn't leak keys, but we have all been the person to 'rm -rf /' or 'delete * from prod where 1=1;', so it's just a matter of time. Is there a plugin that streamers could use to blur suspected keys on stream? Would that be something interesting to work on do you think? (I'm not a streamer but it sounds fun)
When I was looking into the streaming side of things I set up an overlay image which could be toggled with a hotkey to hide my screen (it actually also hid my desktop scene too in case the image didn't load or whatever)
My main precaution though was separating dev/prod and never looking at prod stuff online. Worst case someone could spin up some guff in my dev/test account until I can cycle the credentials
In my case the separation also included a different system user on my computer for stream work. Possibly overkill but why risk it when the costs are so low?
I can't see myself trusting a key blurring app if I'm honest. Rather fix the issue earlier in the process than rely on something that would probably break on edge cases (word wrap enabled? Here's the key but it's in two parts, that sort of thing)
Re: Billion-record stolen Chinese database for sale on breach forum
#245Earlier quoted context omitted.
Vault is not just a drop in and go system - setting up a vault instance is an ordeal in and of itself, and the pricing for vault on hashicorp cloud is incredibly expensive. The problem with the other options is that you have to get the secrets into environment variables, or out of github/lab secrets and into your application. To use most of the services like AWS secrets manager, vault, etc, it will cost you more to m…
Self-hosted Vault within a minimum Kubernetes cluster in GCP costs us roughly $35 a month. Maintenance effort can be neglected if not scaling. Vault has its learning curve there but I think it's totally worth it, given its secret management and API-first features integrated with many other DevOps tools.
$35/month is more than a small team will pay on source control.
Re: Billion-record stolen Chinese database for sale on breach forum
#246Earlier quoted context omitted.
I don't think Chinese people actually cares, most people don't even know what "Data" actually is, let alone how "Data" effects them. The altitude of most people here (I'm a Chinese BTW) is "I did nothing wrong, so why should I care?". But, it's one thing to hear the humor, it's another thing when you can actually see it. People will have different opinions about privacy when their wives asks them why their business t…
>People will have different opinions about privacy when their wives asks them why their business trip to another city showed up as a hotel night 500 meters away from home on the government database. Had a good chuckle. But then it got me thinking about other situations in which government-leak-induced friction that might lead to cause for legal action. The government demands and collates data presumably supported by…
According to the Network Security/Safety (it's the same word in Chinese) Law, the network operator is responsible to ensure the security of their system, which includes 1) setting up security and auditing rules, 2) prevent virus, hacking and other attacks, 3) monitor and record the status of the network and perform backups etc.
The law has also stated that if an institution violated the law, and civil damages is generated as result, the institution is also responsible for the damage.
There is another law which might also apply to this case, it's called Data Security/Safety Law. This law also stated that the institution is responsible for civil damages if the institution has violated the law.
But, I'm not a lawyer and certainly not a Chinese lawyer. This situation is fairly complex already, it's hard for me to tell which direction this case would go.
I guess they'll investigate it first, but the company/team which worked on the project has probably already read the laws before, thus I assume they're well-prepared for this. Another twist is the programmer who accidentally published the secret database API key to the public network, this needs to be investigated as well to determine whether or not the key has actually been used in the attack.
So I guess in the meantime, the husbands must wait.
Re: Billion-record stolen Chinese database for sale on breach forum
#247Earlier quoted context omitted.
> Do you really believe, that us being on an utopian trajectory is realistic? Oh yes. Very much so. In fact, by many measures we have been on an utopian trajectory for several centuries. Today even our failures are the result of unimaginable power. We have to learn to wield our power with wisdom. We have all of the physical technology we need already. We can practice regenerative agriculture that increases topsoil fe…
I would love to be in touch with you. The quality utopianists are hard to come by.
Cheers! Aren't you kind. :)
I have a mailing list: https://lists.sr.ht/~sforman/heliotrope.pajamas
And I lurk on (my own) IRC channel: irc://irc.libera.chat/#MagnusMotive
I'm pretty weird and flakey, but I'm also committed and serious (though not humorless) about working towards the nice future. :)
I see you have an email addy in your profile, I'll email you a little later today, after more coffee.
Re: Billion-record stolen Chinese database for sale on breach forum
#248Apparently there was a "blogpost" of a developer showing of their code, where they accidentally leaked access tokens in a piece of commented code: https://archive.ph/mP3bh This is completely unverified though, so take it with a grain of salt.
It's incredibly disappointing actually how often this happens. I can't count the amount of SO questions I've had to edit from others posting live API Keys for everything from custom services to AWS.
Indeed, last year we detected on average 84 AWS IAM creds for every 10k commits pushed to GitHub
https://res.cloudinary.com/da8kiytlc/image/upload/v164614852...
Re: Billion-record stolen Chinese database for sale on breach forum
#249Earlier quoted context omitted.
It's incredibly disappointing actually how often this happens. I can't count the amount of SO questions I've had to edit from others posting live API Keys for everything from custom services to AWS.
I wonder if you could make a luhn-like check that would require an additional approval step to post if it comes back positive. Something like "It looks like you may be posting a secret *****. Do you wish to continue?
Unfortunately, it's not as simple as that.
Lots of secrets are "generic" (think of a DB user/password combination), meaning that you need to take into account the surrounding source code context to be able to determine if they are a "real" secret.
Here is a full explanation if you are interested: https://blog.gitguardian.com/why-detecting-generic-credentia...
Re: Billion-record stolen Chinese database for sale on breach forum
#250Earlier quoted context omitted.
Speaking as an Asian American, no, let's not do that.
Ok; could you suggest an alternate? Would be handy to have a shorthand to refer to the incident
How you come up with a name is up to you and how you use it. Personally I would go with "July 2022 Shanghai National Police database leak" because I'm not having any conversation where a cute codename would be less confusing.
At work we codename security issues we are working on for Slack channels, etc. We use unrelated names that you could get from a name generator.