31–40 of 93 posts
> Web3 We’re still doing that?
0 - https://topenddevs.com/podcasts/javascript-jabber/episodes/w...
Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? Edit: and what’s the best practice here? Is it using a key management system of some sort? (I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API)
For example most/all VPS provider allow you to give extra data to the machine; this could be the secrets directly or maybe a connection url to a local* redis server with the configs.
Or you can copy paste a file vis ssh.
*AWS-like providers allow you to also deploy private networks so that only approved services vps can access a db
Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? Edit: and what’s the best practice here? Is it using a key management system of some sort? (I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API)
When you deal with high value amount of cryptocurrencies, you have a hardware wallet so things like these are not even possible in the first place, as the keys are safely stored in the hardware. Storing anything on disk (unencrypted at that) that corresponds to $40K is basically begging to be stolen from you.
Besides that, when you open source something that even has a chance of containing something you don't want to make public, you read through every single file before hitting publish.
> I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API
Commonly you use environment variables for this. So the code references `process.env.MY_SECRET_VAR` or equivalent, and then you set that variable inside your server. That's the simplest way, then there are more complex/"secure" ways too, quick search for "secrets management" in your favorite search engine will tell you more.
> Web3 We’re still doing that?
Has it died? I am getting mixed signals. For example, the Javascript Jabber podcast, which targets front-end web developers in general, ran an episode with some sort of introduction to web3 (and not in the negative sense) just two months ago [0]. 0 - https://topenddevs.com/podcasts/javascript-jabber/episodes/w...
Yes. All the web3 influencers are on AI now.
> In 2023, Guan posted his opinion on smart contract engineers. According to Guan, projects that pay smart contract engineers $200,000 are “ngmi,” which is short for “not gonna make it.” The Web3 founder said that any solid developer “should be able to write solidity with the help of ChatGPT.” Ah, schadenfreude.
This is your reminder that every crypto"currency" using a transaction fee is fundamentally a scam and everything that is happening using them is merely hype to get you involved in them.
Fees are for inclusion of a transaction in a block. And some pretty clever game theory was implemented as part of eip1559 in Ethereum to make fees efficient and fair.
Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? Edit: and what’s the best practice here? Is it using a key management system of some sort? (I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API)
> Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? When you deal with high value amount of cryptocurrencies, you have a hardware wallet so things like these are not even possible in the first place, as the keys are safely stored in the hardware. Storing anything on disk (unencrypted at that) that corresponds to $40K is basically begging to be stolen fr…
If you’ve got that much money in a project, it’s not a prototype. This repo should have had all types of static analysis running automatically. Hell, GitHub has built in secret scanning. Apparently it was only set as the default for all new repos in March 2024[]. [] https://docs.github.com/en/code-security/secret-scanning/con...
How does the monetary value matters? A prototype is a prototype, a quick project to test some concept. If you wanna test some concept around large transfers, does that mean it's suddenly not a prototype?
> This repo should have had all types of static analysis running automatically.
Would that actually prevent this issue? So lets say they make the repository public, the static analysis tool begins screaming at the repo owner. Now, he has 2 minutes to transfer those funds somewhere (manually), before the thief automatically makes that transfer for them, to their own wallets.
Sounds like the guy just needed a hardware wallet instead of whatever they were doing. Who stores unencrypted wallet details containing $40K on disk?! Committed to git?!
Earlier quoted context omitted.
>Some cryptocurrency isn't a safe store of value to begin with... If I may, I would posit all crypto is not a safe store of value to begin with. An EMP taking out the entire world power grid would render crypto pretty useless almost immediately, while gold will just sit there. Even paper money is resistant to decentralized unwindings as they are physical and people are conditioned from birth to accept their value.
In the scenario of an EMP taking out the entire world grid you'll be trading potatoes, cigarettes and bullets, not gold and dollar bills
> When a community member inquired about how long it took for the funds to be drained, the Web3 founder responded that it took just two minutes for someone to withdraw the funds. The public events API is delayed by 5 minutes[1]. Unless someone was actively scraping his profile rather than doing large scans on GitHub, this is not possible. [1] https://docs.github.com/en/rest/activity/events?apiVersion=2...