101–110 of 266 posts
This is a good example of the increased risks from doing your development out in the open, any mistakes are exposed to a much wider group of potential adversaries. On an internal VCS, this would still be a problem, but a bit less visible/exploitable...
For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it. https://rtyley.github.io/bfg-repo-cleaner/
I get it...you like github but you don't want to pay for private repos. That's when you use Gitlab or BitBucket and then this problem goes away.
Related topic: "Production AWS keys on GitHub" ~ 3 years ago https://news.ycombinator.com/item?id=7411927 By just looking quickly, it seems that you can still find many recent live keys...
Amazon scans GitHub and revokes valid keys (can't find source, but proof is that it's been a while no AWS keys were stolen from GitHub)
Computers are supposed to be good at what imperfect humans are not. This only proves how primitive the tool is. That is, for example, if Gmail can ask "it looks like you forgot the attachment" why can't Git say "this is a public repo and you're about to commit and push passwords. Are you sure?" It's going to be easier to fix the tool than it is to make humans be perfect.
Gmail can make a simple keyword search for a handfull of phrases in something that's known to be text Git would have to first decide whether a file is a textfile or binary file, a decision that can be done reasonably well heuristically but that is undecidable in the general case. Then it has to parse text files for a long, curated list of known keywords that are only used for storing API keys and are not (usually) us…
People...seriously... I get it...you like github but you don't want to pay for private repos. That's when you use Gitlab or BitBucket and then this problem goes away.
People...seriously... I get it...you like github but you don't want to pay for private repos. That's when you use Gitlab or BitBucket and then this problem goes away.
Well, we suppose that's a solution of some kind. How about never committing passwords and having passwords hardcoded in your codebase?
For anyone wondering, if you want to remove a file or secret you've already committed, you can use BFG Repo-Cleaner to go through your commit history and completely remove any trace of it. https://rtyley.github.io/bfg-repo-cleaner/
Sounds like a better idea to just change the secret.