61–70 of 272 posts
Earlier quoted context omitted.
In the meantime, try ggshield cli https://github.com/GitGuardian/ggshield
Nah thanks, I'm already running Trufflehog for free on all of our multiple orgs' thousands of repos. I think we would consider GG if its pricing was acceptable for non-profits though.
Earlier quoted context omitted.
Nah thanks, I'm already running Trufflehog for free on all of our multiple orgs' thousands of repos. I think we would consider GG if its pricing was acceptable for non-profits though.
FYI - GitGuardian is free for individuals and teams smaller than 25
Earlier quoted context omitted.
I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it. I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.
GitHub PM here. Glad that was a good experience! We work with ~50 partners (details in the link below) to notify them when tokens for their service are exposed in public repos, so that they can notify you. https://docs.github.com/en/code-security/secret-scanning/sec...
Earlier quoted context omitted.
Those three are not all equal. "Production keys in source control" is the equivalent of a surgeon not washing their hands between between surgeries. It's basic level of professional competency that should not be violated. The latter two are bad mistakes, which shouldn't happen but do.
Surgeons have a practiced ritual ("scrubbing") to prep for surgery. Do you practice a credential-scanning ritual before saving (committing) your code or pushing your code to a remote repo? I have git hooks to lint code syntax, but nothing for scanning for leaked credentials. Looking @ TruffleHog now, mentioned by another poster.
It can actually be comical just how _bad_ things can be at large orgs. Anyone have details, theories, or a book on how such inefficiencies come about? I can't speak to tech-oriented large orgs but I've worked with others and its just... I'm not shocked at all. I've seen public facing API keys in HTML, private SSH keys that do god knows what in plaintext on FTP servers... I just don't understand how they seem to care…
In my experience, security is so far removed from the actual job description/day to day cares that it's perpetually "somebody else's problem", seen as an unnecessary time sink. Usually there's a couple of people that actually care, but they're ignored and lack the power to influence change. Not lazy, just overburdened by more important things.
At larger orgs, I notice they take it "seriously" but that results in people finding creative loopholes... like pasting in all the important production keys/passwords into a google doc and sharing the google doc because they "can't send secrets over slack" ... lol
It can actually be comical just how _bad_ things can be at large orgs. Anyone have details, theories, or a book on how such inefficiencies come about? I can't speak to tech-oriented large orgs but I've worked with others and its just... I'm not shocked at all. I've seen public facing API keys in HTML, private SSH keys that do god knows what in plaintext on FTP servers... I just don't understand how they seem to care…
The building has multiple methods of access at different stages. During the course of doing your job, you don't follow the proper protocols a few times. You closed a door without re-entering a lock code. You didn't check someone's badge and ID at the third floor access gate. You forgot to make sure someone swiped out on exit.
Nobody actually trained you on any of those protocols; they just made you watch a "security is everyone's responsibility" video and then expected you to know all the protocols. Maybe once or twice you were lazy, but it's equally likely you just didn't know what to do. And once you make that mistake, somebody can exploit it as long as you don't follow the protocol.
In facilities where security is important, there are safeguards. Doors left open sound an alarm, automatically lock when closed, and sensors detect if more than one person walks through without badging in. These safeguards exist because people are fallible and need help to enforce security. Companies without security safeguards either don't care, or are ignorant.
I wish hosted GitHub made pre-push hooks available to the public. Would make this a much easier problem with free scanning tools like Trufflehog. Or alternatively, if GitHub Secret Scanning was available to all public repos, instead of requiring a (very) expensive GitHub Advanced Security subscription. But I understand, they need to make money somehow.
(GitHub PM here.) The Advanced Security secret scanning experience is coming to public repos (for free, obviously)! Give us a few more months - we have a little more work to do scaling it up
Many years ago I got a trial license key for something, Aspose components of some sorts I think, and without thinking of it, checked it in into public Github repo. Well, few days later Aspose's support sends me a nicely worded note saying that they noticed that it was there and invalidated it for me. Their description and instructions were very clear about why they did it and why I shouldn't have checked it in. I tho…
I actually had something similar happen to me last month. I accidentally published a discord API key to GitHub and within minutes I got a nice message from “Safety Jim” to my personal discord account letting me know they’ve found my key on a public repo and have gone ahead and revoked it. I felt like a bit of a dope but it was neat to have it happen to me. Lesson learned for sure.
Earlier quoted context omitted.
Doctors used to not wash their hands too. I get it though, and i've seen the same thing. Really it comes down to education and not granting access to secrets to people who aren't capable of handling them.
"fun" fact - there could potentially be thousands of deaths attributed to Drs simply not washing their hands. IIRC they even basically got some hospital admin fired for creating a hand washing mandate, despite it being proven to save lives. https://www.npr.org/sections/health-shots/2015/01/12/3756639... (talking centuries ago, but maybe even today) Looks like its still a "recent" issue, lol https://www.nytimes.com/20…