Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I scanned all of GitHub's "oops commits" for leaked secrets

trufflesecurity.com

Post reply on HN
Print view View original

111–117 of 117 posts

Re: I scanned all of GitHub's "oops commits" for leaked secrets

#111

Post by whyever »

oefrha wrote: post #64
whyever wrote: post #40

Earlier quoted context omitted.

If you rotated the secret, why do anything else? I don't think there is any potential further damage (except maybe reputational).

1. Not all secrets can be rotated. E.g. I can't just "rotate" my home address, which I prefer to be private. 2. Even for rotatable secrets, "I don't think there is any potential further damage" rests on the assumption that the secret is 100% invalidated everywhere. What if there are obscure and/or neglected systems, possibly outside of your control, that still accept that secret? No system is bug-free. If I can take…

Ok, so how would such a secret end up in a commit? E.g., I don't see why I would have my home address anywhere close to a code repository. Maybe if I used the wrong "secret" email address when authoring the commit?

If it's not possible to invalidate your compromised software secrets, I would argue that you have bigger and more urgent problems to fix. But fair enough: Deleting them from GitHub might reduce the impact in such cases.

Re: I scanned all of GitHub's "oops commits" for leaked secrets

#115

Post by oefrha »

whyever wrote: post #111
oefrha wrote: post #64

Earlier quoted context omitted.

1. Not all secrets can be rotated. E.g. I can't just "rotate" my home address, which I prefer to be private. 2. Even for rotatable secrets, "I don't think there is any potential further damage" rests on the assumption that the secret is 100% invalidated everywhere. What if there are obscure and/or neglected systems, possibly outside of your control, that still accept that secret? No system is bug-free. If I can take…

Ok, so how would such a secret end up in a commit? E.g., I don't see why I would have my home address anywhere close to a code repository. Maybe if I used the wrong "secret" email address when authoring the commit? If it's not possible to invalidate your compromised software secrets, I would argue that you have bigger and more urgent problems to fix. But fair enough: Deleting them from GitHub might reduce the impact…

That's just an example... To give a more real example, I have accidentally committed and pushed my own private data (e.g. from my private social feed) used in testing. That could include my address too, so the example was quite possible to begin with.

Re: I scanned all of GitHub's "oops commits" for leaked secrets

#116

Post by notachatbot123 »

emmelaich wrote: post #79
Pwhy1 wrote: post #21

Maybe I missed it but the article doesn't mention the even easier way to see this: the activity tab. It has everything. Any force push to hide ugly prototype code is kept forever which annoys me. I wish we were able to remove stuff from there but the only way to do it is to email support it seems? Here it is for the test repo mentioned https://github.com/SharonBrizinov/test-oops-commit/activity

I guess it's possible to delete these forever as by deleting the entire repo and re uploading. As long as there are no forks.

Before that it will have been ingested by at least Microsoft into AI and what not.

Re: I scanned all of GitHub's "oops commits" for leaked secrets

#117

Post by null_deref »

bdcravens wrote: post #110
null_deref wrote: post #109

Earlier quoted context omitted.

Ok I may have misread the pricing model, I’ll look into it, thanks!

To be clear, Parameter Store is a separate product from Secrets Manager, but is essentially the same thing without features like the UI, key rotation, etc. Functionally though, they're the same (for example, passing secrets into an ECS container is just a matter of passing the ARN)

Thank you! Just implemented this in my lambda, still a bit frustrated there is no easy way to push env vars from the deploying machine
Post reply on HN