Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tencent WeChat is now a GitHub secret scanning partner

github.blog

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Tencent WeChat is now a GitHub secret scanning partner

#131

Post by rightbyte »

boomboomsubban wrote: post #124
rightbyte wrote: post #102

Earlier quoted context omitted.

His oppositions seems to be nitpicking and he says it is fine for hosting?

The issues with the way they handle commits is a fairly fundamental disagreement, one that ensures he will never use github for development without it being changed.

Ye well he says the web interface sucks and that "pull request" do too. Like, all their value add.

I have never tried Github's web interface but I guess not being able to write tab is the first thing that pissed Linus off.

Re: Tencent WeChat is now a GitHub secret scanning partner

#132

Post by civopsec »

atonse wrote: post #101
civopsec wrote: post #88

Earlier quoted context omitted.

Scanning repos for secrets has been a thing for a while now. But seeing Tencent might put people on edge.

Secret scanning is a thing. But this is an excellent next step where they build an integration with these partners where, as soon as a secret is scanned, they can notify tencent/AWS/other providers automatically to instantly invalidate those keys before they’re abused. That’s what’s novel here.

I wasn’t commenting about whether it was novel or standard practice. OP seemed to have gotten the heebie-jeebies from the submission title.

Re: Tencent WeChat is now a GitHub secret scanning partner

#133

Post by civopsec »

trompetenaccoun wrote: post #82

To everyone portraying this as harmless and as Wechat just looking for security breaches: Tencent itself is the security breach. Not only can Chinese ppl not sign up without providing a phone number, just to get a SIM card they now take your government ID, a picture of your face and a fingerprint! Xi is making absolutely sure that every single internet user is IDed and has their conversations tracked on apps like Wec…

Imagine if someone protested against Finnish–Russian cooperation on search-and-rescue operations near their border because the evil Russian government could be searching for political dissidents to imprison. That’s what your comment sounds like.

This is about preventing things like API keys from being published to code. That’s not a dissident use-case…

Re: Tencent WeChat is now a GitHub secret scanning partner

#134

Post by hunter2_ »

b4je7d7wb wrote: post #94
hunter2_ wrote: post #62

Earlier quoted context omitted.

GitHub is indeed giving WeChat our information, but only when it looks just like WeChat secrets, and only once it's already publicly leaked (any leaked via private repo instead goes to the repo admin). So technically the answer to GP is 'yes'.

I dont think you can claim an API key is your information. It is quite by definition information created by WeChat and Github is sharing only that with them a few minutes before it shares it with bad actors.

It's not necessarily created by WeChat. It just needs to follow the same pattern as a key generated by WeChat (thus all the .* regex jokes here). It could very well be anyone's information, but information about to be public anyway (making "yes" the answer to the question "Isn't this information already public?").

Re: Tencent WeChat is now a GitHub secret scanning partner

#135

Post by jopsen »

oefrha wrote: post #120
jopsen wrote: post #118

Earlier quoted context omitted.

> Or is that nonsense? Yes, that is nonsense. 1) secret scanning can be disabled (not even sure it's enabled by default). 2) the regexes are fairly specific, length limited, etc. 3) github is obviously reviewing regexes that are accepted. Check the list of stuff supported: https://docs.github.com/en/code-security/secret-scanning/sec... A bit sad, they don't publish the list of regexes, etc. -------------- I added a s…

Once again[1][2], scanning alerts on private repos are only sent to owners. Whereas public repos are, you know, public. It's really tiring that people correct other people's misinformation when they themselves haven't read the bold bullets points in "Learn more about secret scanning"[3] and end up totally missing the point. [1] https://news.ycombinator.com/item?id=34067335 [2] https://news.ycombinator.com/item?id=340…

Ah yeah, that's a good point.

Honestly, I'm just very happy GitHub is doing this, because we've all made these mistakes. And it's so easy for then to hide in git revision history. Only the be found when someone scans for the secrets.

Re: Tencent WeChat is now a GitHub secret scanning partner

#136

Post by AntiRemoteWork »

whoevercares wrote: post #63

It’s absolutely shocking to observe how hostile HN is to Chinese affairs. While in real life many must have collaborated A LOT with Chinese engineers & managers. Are you worry about bias bleeding into real life? I’m indeed worried as a Chinese immigrant working in tech

No post body was provided.

Re: Tencent WeChat is now a GitHub secret scanning partner

#137

Post by pontilanda »

trompetenaccoun wrote: post #130
anaganisk wrote: post #85

Earlier quoted context omitted.

Wait a second, the requirement of a government to get a sim card is kinda standard practice in multiple countries. Also, when it comes to privacy, US based companies must be last ones to talk, like as if China is the only bad guy who infringes upon peoples right to privacy. China is dangerous, but it's not the only dangerous thing in the room. Also, your comment doesn't make sense. If you are committing your public c…

You may have misunderstood. There is no way to anonymously access Weixin from China unless you have hacked credentials. You need a phone number. Note that local Weixin and foreign Wechat are not the same. Last time my Mainland friend bought a SIM card the vendor had a government app on his phone, snapped a picture of my friend's face, scanned the ID (身份证) and had him take a fingerprint with a reader he also had conne…

> There isn't a country in the world which does this

Does what? The thing extra is the fingerprint but literally every modern country requires ID registration and more. My government also knows this IP belongs exactly to me. Stop spouting nonsense.

Plus this is completely unrelated.

Re: Tencent WeChat is now a GitHub secret scanning partner

#138

Post by pontilanda »

ilyt wrote: post #79
pontilanda wrote: post #33

Earlier quoted context omitted.

I cannot see the issue because the regex are pre-approved by GitHub. And even then, the service will only return the string, not who wrote it. Unless GitHub approves /Jonh Doe said:.*/ there is no issue whatsoever.

Yeah because it is oh-so-easy to ensure your regexp matches only your company's tokens and not 10000 other companies tokens /s

And? What are you going to do with a singular token that you don’t know what company it belongs to? But obviously those devs at GitHub don’t know what they’re talking about so they’ll gladly notify two companies at once.

It’s super easy too: take a look at GitHub’s tokens, they all start with gh.

Re: Tencent WeChat is now a GitHub secret scanning partner

#140

Post by snehk »

trompetenaccoun wrote: post #130
anaganisk wrote: post #85

Earlier quoted context omitted.

Wait a second, the requirement of a government to get a sim card is kinda standard practice in multiple countries. Also, when it comes to privacy, US based companies must be last ones to talk, like as if China is the only bad guy who infringes upon peoples right to privacy. China is dangerous, but it's not the only dangerous thing in the room. Also, your comment doesn't make sense. If you are committing your public c…

You may have misunderstood. There is no way to anonymously access Weixin from China unless you have hacked credentials. You need a phone number. Note that local Weixin and foreign Wechat are not the same. Last time my Mainland friend bought a SIM card the vendor had a government app on his phone, snapped a picture of my friend's face, scanned the ID (身份证) and had him take a fingerprint with a reader he also had conne…

> There isn't a country in the world which does this.

My government requires me to have ID, which contains a photo and finger prints and you cannot get a SIM without ID. That's Germany and it's true for many, many countries.

Post reply on HN