Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

humankode.com

Post reply on HN
Print view View original

11–20 of 110 posts

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#11

Post by kylec »

Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

This is a really good point. There was another post recently linking to a search for id_rsa files (SSH private keys) on GitHub. Instead of allowing people to publish sensitive things like that accidentally, GitHub really should require an extra confirmation.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#13

Post by tomschlick »

Analemma_ wrote: post #5

This is becoming such a common story that I'm starting to think it's a little irresponsible of both Amazon and GitHub to not react better to it. Clearly Amazon is capable of detecting when this happens as evidenced by their rapid response; when they see AWS keys published to GitHub, they should block the account, or at least prevent it from spinning up any new instances. They can then contact the owner over e-mail to…

> or at least prevent it from spinning up any new instances

This is the answer I would like to see implemented. If they can detect the key they can put a freeze on the account so that only existing resources are available.

They should also have a timeline of all created instances in every zone so you can see what has happened in the last x hours and kill all instances at once.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#14

Post by blablabla123 »

Most UIs for programmers still seem to lag behind the command line tools a lot. I wonder if it will be possible again some day to create apps like in Delphi without some black magic happening in the background.

P.S.: never ever put keys into repositories. Except those repos are deployment config only.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#15

Post by williamcotton »

TimothyFitz wrote: post #4
mahouse wrote: post #3

Are we really going to run this story every month? "I posted my private AWS keys by mistake on github, a spider got them, I got a huge bill" Yeah, you don't say

He didn't post it by mistake. He asked Visual Studio to create a private repo and it created a public one. A bug which he reproduced.

Sure, but he shouldn't have checked keys in to any repo, public or private!

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#16

Post by travoc »

mbrutsch wrote: post #8
ocdtrekkie wrote: post #2

I still find it amazing that AWS doesn't offer any way to hardcap your billing and cut off service.

There's really no financial incentive to do so.

When people run up a huge bill and don't pay it, that's an incentive.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#17

Post by nathancahill »

tonywebster wrote: post #6
mahouse wrote: post #3

Are we really going to run this story every month? "I posted my private AWS keys by mistake on github, a spider got them, I got a huge bill" Yeah, you don't say

Don't be so quick to dismiss this one. This is notable for several reasons, including (1) it wasn't his mistake, but rather that of a Visual Studio bug not following his instructions to make a private repo on GitHub; (2) the speed in which this happened (minutes), and (3) it has useful analysis into some sorely lacking functionality in AWS that lets this continue to happen.

I don't know. Even for private repos, it's bad practice to commit private keys to source control.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#18

Post by gregmac »

tonywebster wrote: post #6
mahouse wrote: post #3

Are we really going to run this story every month? "I posted my private AWS keys by mistake on github, a spider got them, I got a huge bill" Yeah, you don't say

Don't be so quick to dismiss this one. This is notable for several reasons, including (1) it wasn't his mistake, but rather that of a Visual Studio bug not following his instructions to make a private repo on GitHub; (2) the speed in which this happened (minutes), and (3) it has useful analysis into some sorely lacking functionality in AWS that lets this continue to happen.

Well, it is partially his mistake, which he acknowledges:

> I am certainly not innocent here and some mistakes were made on my part. [...] To this end, having encrypted access keys or excluding configuration settings from GitHub would have prevented the AWS charges - and this is certainly the approach I would take from now on.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#19

Post by slg »

Does Amazon actually end up charging you when this type of thing happens or do they eventually wipe the bill after you talk to support? If Amazon tried to charge me, I would definitely be in touch with the credit card company I have attached to the account. This is rather straightforward fraud/identity theft so you should be covered by the standard consumer protections most credit card's provide.

Re: How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

#20

Post by forrestthewoods »

famousactress wrote: post #7

"As a senior developer with over 12 years of experience in the financial services industry, I didn't think it was possible that I could be the victim of a data breach." We're only one sentence in and I'm already very, very nervous about the author's hubris.

I took it less as hubris and more of a way to imply to readers that no matter their experience they are not immune to the mistake he is going to tell you about.
Post reply on HN