I scanned all of GitHub's "oops commits" for leaked secrets
trufflesecurity.com
I scanned all of GitHub's "oops commits" for leaked secrets
1–10 of 117 posts
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#2I find it hard to believe that they could have made $25k with this. There are companies that scan all commits on gh for secrets, using similar techniques for finding secrets in files.
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#3Git never forgets, this isn't really a shocking revelation.
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#4I find it hard to believe that they could have made $25k with this. There are companies that scan all commits on gh for secrets, using similar techniques for finding secrets in files.
Congrats on commenting without reading the article.
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#5Git never forgets, this isn't really a shocking revelation.
What specific property of git mandates a website to not clean up those dangling commits?
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#6Maybe a default secure delete option could be made a lower bar event?
Checkout to event, commit in clean state with prior log history, overlay the state after the elision and replace git repo?
When I had to retain log and elide state I did things like this in RCS. Getting date/time info right was tricky.
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#7An interesting look at one of the consequences of using git and public repo's.
Does leave me wondering how long before someone has a setup which detects and tries to exploit these in real-time, which feels like it could be nasty.
Also a challenge with these posts is they were unlikely to have been able to contact all the affected developers who have got exposed secrets, meaning that any that were uncontactable/non-responsive are likely still vulnerable now, I'd guess that means they're about see what happens if those secrets get abused, as people start exploring this more...
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#8An interesting look at one of the consequences of using git and public repo's. Does leave me wondering how long before someone has a setup which detects and tries to exploit these in real-time, which feels like it could be nasty. Also a challenge with these posts is they were unlikely to have been able to contact all the affected developers who have got exposed secrets, meaning that any that were uncontactable/non-re…
There are already people scanning git repos for Bitcoin/Ethereum/crypto keys and exploiting them immediately.
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#9Git never forgets, this isn't really a shocking revelation.
Git does forget, it has a gc mechanism specifically for forgetting.
GitHub can't use the native git gc, and apparently doesn't have their own fork-aware and weird-cross-repo-merge-aware gc, so they might just not have built a way to track which commits are dangling.
But that's not obvious at all.
Re: I scanned all of GitHub's "oops commits" for leaked secrets
#10Git never forgets, this isn't really a shocking revelation.
Git is not point in time backups. It is versioning.
You are free to organize your version history as you fit, and you can certainly rewrite history.
The only issue you might have is signed commits from collaborators, that you can not resign.