I'm much more interested in what the private model "tweet-rejector" could be used for...
if "Musk" in tweet and xAi.grok.sentiment(tweet) xAI dev leaks API key for private SpaceX, Tesla LLMs
51–60 of 83 posts
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#52Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#53Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#54Earlier quoted context omitted.
> Guess who's going to be fired by elon :D i know, you probably just meant it as a fun comment. but i don't get how this is funny. this person probably relies on income, might have a family to feed... and just made a mistake. a type of mistake, that is not uncommon. i mean i have seen corporate projects where senior engineers didn't even understand why committing secrets might be a bad idea. yes, of course, as a engi…
> if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again If they were good at their job, they wouldn't have leaked the secret in the first place. The correct workflow is to: 1. Create commits that only change do one thing. Not possible to "forget" there were secrets added alongside another feature. 2. When adding secrets, make sure they're encr…
In a vacuum, sure. But in a workplace this workflow is best practice at best and even gets ignored. I've been able to accidently add a secret despite scans and I noticed it myself so it was quickly fixed. Still resulted in a discussion of how to prevent it in the future as nothing is perfect and you learn from mistakes.
Or you don't by simply firing the engineer and assume everyone in the entire workflow is perfect.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#55Earlier quoted context omitted.
I only use private repos, so that when my .ssh and .env leaks the public doesn’t see it. Probably. Maybe. Well…
Git implemented a `.gitignore` file for this exact purpose. One of the first things to do when you create a new repo is to customize if for the language + OS.
And .env is implemented for this exact purpose too, hand-in-hand with .gitignore ;)
But mistakes happen all the item. It's very easy to fat-finger a line in .gitignore - one char off and you're toast.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#56Earlier quoted context omitted.
How would you accidentally leak your .ssh dir on Github?
People with workflows like `git add .; git commit -m 'fix'` can push wondrous things to public repos.
You would have to have a git repo in .ssh or higher up the tree for that to work. Otherwise you’d get one of the “directory is not a repo” messages.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#57Earlier quoted context omitted.
I only use private repos, so that when my .ssh and .env leaks the public doesn’t see it. Probably. Maybe. Well…
Just remember to go through your commit history if you ever plan on making that repo public.
I use the Pieter Levels commit history strategy of all my commit messages being the single word "commit"
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#58Earlier quoted context omitted.
> Guess who's going to be fired by elon :D i know, you probably just meant it as a fun comment. but i don't get how this is funny. this person probably relies on income, might have a family to feed... and just made a mistake. a type of mistake, that is not uncommon. i mean i have seen corporate projects where senior engineers didn't even understand why committing secrets might be a bad idea. yes, of course, as a engi…
> if this person is actually good at their job and takes it seriously, it's certain: he or she is not going to leak a secret again If they were good at their job, they wouldn't have leaked the secret in the first place. The correct workflow is to: 1. Create commits that only change do one thing. Not possible to "forget" there were secrets added alongside another feature. 2. When adding secrets, make sure they're encr…
This sounds like naivety to me. I would bet most people here have committed a secret, even if it was later caught in a code review. If this wasn’t a common issue, all those tools that scan repos for secrets wouldn’t exist.
I once put secrets on a wiki page because I copied log snippets and a third party library naively dumped HTTP headers into the logs without filtering out their own API key. I shouldn’t have assumed the logs were secret free, but it’s also not an unreasonable assumption.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#59What absolute incompetence. Not just on this dev, but any org with API keys ought to be scanning for leaked keys constantly. Failure of one and failure of many. Of course Elon hires only based on 'merit'...
How would you scan for your api keys on repos outside of your organization? I assumed this was a dev’s personal repo.
The company I work for does this. I recently pushed an update to a personal repo that just contained a keyword match (the push included a dictionary.txt file which happened to include the company name) which flagged a review.
Re: xAI dev leaks API key for private SpaceX, Tesla LLMs
#60Earlier quoted context omitted.
This being Musk, it wouldn't surprise me. I mean, consider The Boring Company sell a "flamethrower" despite being theoretically about… boring.
Because Tesla is making.. coils?
Boring as the noun, not adjective. Also, Tesla was named that before Musk was involved, so it’s not his humor involved in naming both. Nikola Tesla is known for a lot more than just Tesla coils.