11–20 of 91 posts
Ben Franklin figured this out many years ago:
Three can keep a secret,
if two of them are dead.A few days ago I published my blog to GitHub, with my MailGun API key in the config file (stupid mistake, I know). In less than 12 hours, spammers had harvested the key AND sent a few thousand emails with my account, using my entire monthly limit.
Thankfully I was using the free MailGun account, which is limited to only 10,000 emails/month, so there was no material damage. Their tech support was awesome in immediately blocking the account and notifying me, and then quickly helping to unblock the account after keys and passwords were changed, and repo made private.
I was exactly wondering how they were able to harvest GitHub content so quickly; it couldn't be web scrapping or a random search. This article explains well how to drink from GitHub's events firehose and the GHTorrent project, so everything makes sense now. Thanks for posting it.
EDIT: This other post[1] describes a similar situation. There are some folks monitoring ALL GitHub commits and getting psswords as they are commited, on the fly.
[1] http://www.devfactor.net/2014/12/30/2375-amazon-mistake/
Always use environment variables. They are probably the best way to safeguard your API keys.
Always use environment variables. They are probably the best way to safeguard your API keys.
I've always wondered the proper way to deal with this, and this makes total sense. How would you typically set such an environment variable? In bash init?
[deleted]
Why?