Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 39 Algolia admin keys exposed across open source documentation sites

benzimmermann.dev

Post reply on HN
Print view View original

11–20 of 62 posts

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#11

Post by throwaway5465 »

netsharc wrote: post #9

Man, talk about unnecessary graphs... ok graph 2 is maybe tolerable, although it's showing the popularity of the projects, not a metric of how many errors/vulnerabilities found in those projects. I'm not a newspaper editor, but I think if this was an article for one, they'd also say the graphs are unnecessary. It smells of "I need some visual stuff to make this text interesting"...

It's Friday night / Saturday morning. Who wants to be reading text?

Especially on night mode themes.

Besides, can we read anymore? In the age of 'GPT summarise it me' attention spans and glib commentary not about the content of the article being all many people have to add, perhaps liberal application of visualisations adds digestive value.

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#12

Post by pwdisswordfishy »

wat10000 wrote: post #10
pwdisswordfishy wrote: post #4

Earlier quoted context omitted.

That's just a tautology. "If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them the secrets will be invalidated". The above is a true statement for all X.

English is not formal logic. In formal logic, that statement is true whether X is GitHub, or Lockheed-Martin, Safeway, or the local hardware store. In English, the statement serves to inform (or remind) you that GitHub has a secret scanning program that many providers actually do partner with.

Yes, and in the real world where Grice's Maxim of Relevance is in force, then when the secrets issuer that is the subject of the discussion isn't one of those partners, then an informative "reminder" that GitHub "has a secret scanning program" with a bunch of other partners is not actually informative. It's as superfluous and unhelpful as calling to let someone know you're not interested in the item they've posted for sale on Craiglist (https://www.youtube.com/watch?v=xWG3jKzKcm8>).

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#13

Post by binarymax »

netsharc wrote: post #9

Man, talk about unnecessary graphs... ok graph 2 is maybe tolerable, although it's showing the popularity of the projects, not a metric of how many errors/vulnerabilities found in those projects. I'm not a newspaper editor, but I think if this was an article for one, they'd also say the graphs are unnecessary. It smells of "I need some visual stuff to make this text interesting"...

Dude there’s only three graphs in there. Do they really bother you that much? The third may be a bit unnecessary but I think the visuals add to the post.

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#14

Post by richbell »

pwdisswordfishy wrote: post #12
wat10000 wrote: post #10

Earlier quoted context omitted.

English is not formal logic. In formal logic, that statement is true whether X is GitHub, or Lockheed-Martin, Safeway, or the local hardware store. In English, the statement serves to inform (or remind) you that GitHub has a secret scanning program that many providers actually do partner with.

Yes, and in the real world where Grice's Maxim of Relevance is in force, then when the secrets issuer that is the subject of the discussion isn't one of those partners, then an informative "reminder" that GitHub "has a secret scanning program" with a bunch of other partners is not actually informative. It's as superfluous and unhelpful as calling to let someone know you're not interested in the item they've posted fo…

How is reminding people that they can safely revoke exposed API keys not informative? Why are you being so combative?

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#15

Post by TurdF3rguson »

nightpool wrote: post #7
pwdisswordfishy wrote: post #4

Earlier quoted context omitted.

That's just a tautology. "If the secrets issuer partners with X-corp for secret scanning so that secrets get invalidated when you X them, then when you X them the secrets will be invalidated". The above is a true statement for all X.

? Yes? Toomuchtodo is reminding the author (and other commenters), that github gists are one way to make sure secrets are secured / remediated before making a public post like this. Maybe not the most responsible whitehat action, but I can see it being useful in some cases where outreach is impractical / has failed. Unfortunately, it doesn't look like Algolia has implemented this

I'm not following this at all. It seems like OP is saying if you share a secret in your (private?) gist and give Algolia permission to read the gist, they will invalidate it. But why would the secret be in a gist and not a repo? Also if you're aware enough to add that partner it seems you're aware to not do dumb things like that in the first place.

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#16

Post by [deleted] »

TurdF3rguson wrote: post #15
nightpool wrote: post #7

Earlier quoted context omitted.

? Yes? Toomuchtodo is reminding the author (and other commenters), that github gists are one way to make sure secrets are secured / remediated before making a public post like this. Maybe not the most responsible whitehat action, but I can see it being useful in some cases where outreach is impractical / has failed. Unfortunately, it doesn't look like Algolia has implemented this

I'm not following this at all. It seems like OP is saying if you share a secret in your (private?) gist and give Algolia permission to read the gist, they will invalidate it. But why would the secret be in a gist and not a repo? Also if you're aware enough to add that partner it seems you're aware to not do dumb things like that in the first place.

[deleted]

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#18

Post by richbell »

TurdF3rguson wrote: post #15
nightpool wrote: post #7

Earlier quoted context omitted.

? Yes? Toomuchtodo is reminding the author (and other commenters), that github gists are one way to make sure secrets are secured / remediated before making a public post like this. Maybe not the most responsible whitehat action, but I can see it being useful in some cases where outreach is impractical / has failed. Unfortunately, it doesn't look like Algolia has implemented this

I'm not following this at all. It seems like OP is saying if you share a secret in your (private?) gist and give Algolia permission to read the gist, they will invalidate it. But why would the secret be in a gist and not a repo? Also if you're aware enough to add that partner it seems you're aware to not do dumb things like that in the first place.

If you find an exposed token in the wild, for a service supported by GitHub Secret Scanning, uploading it to a Gist will either immediately revoke it or notify the owner.

Re: I found 39 Algolia admin keys exposed across open source documentation sites

#19

Post by wat10000 »

pwdisswordfishy wrote: post #12
wat10000 wrote: post #10

Earlier quoted context omitted.

English is not formal logic. In formal logic, that statement is true whether X is GitHub, or Lockheed-Martin, Safeway, or the local hardware store. In English, the statement serves to inform (or remind) you that GitHub has a secret scanning program that many providers actually do partner with.

Yes, and in the real world where Grice's Maxim of Relevance is in force, then when the secrets issuer that is the subject of the discussion isn't one of those partners, then an informative "reminder" that GitHub "has a secret scanning program" with a bunch of other partners is not actually informative. It's as superfluous and unhelpful as calling to let someone know you're not interested in the item they've posted fo…

It's more useful than telling someone that their statement is a tautology in formal logic.
Post reply on HN