Live data from Hacker News

Developer posts secret key on GitHub, loses $40K in 2 minutes

cointelegraph.com

21–30 of 93 posts

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#21
Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos?

Edit: and what’s the best practice here? Is it using a key management system of some sort? (I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API)

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#23
post #5

Earlier quoted context omitted.

>Some cryptocurrency isn't a safe store of value to begin with... If I may, I would posit all crypto is not a safe store of value to begin with. An EMP taking out the entire world power grid would render crypto pretty useless almost immediately, while gold will just sit there. Even paper money is resistant to decentralized unwindings as they are physical and people are conditioned from birth to accept their value.

An EMP taking out the entire world power grid would be a complete disaster for everyone. Goldbugs and people with cash in their mattresses included.

Money is a key part of the formation of societies and history shows that many independent civilisations came up with money time and time again.

Gold is a great form of money thanks to its unique chemistry:

Its colour and lustre is unique - it's fairly easy to tell something is gold-ish by eye and weight. This is why gold was chosen by our low-tech forebears.

Its lower melting temp makes it easier to purify than say Platinum or even Aluminium.

Its inertness (thanks in part to the relativistic contraction of the 6s orbitals) mean that you can leave it in a safe for 1000 years and it'll basically be the same. You literally need conc HNO3 and H2SO4 aka aqua Regis to dissolve it.

People who think gold is a pet rock and is useless fail to appreciate that even if all stores of value are pointless and arbitrary, we still gravitate around particular stores for a reason.

I'd be fairly happy to hang onto some gold in a post Apocalyptic world if it looks like society may eventually recover.

Even stuff like coffee and oil would be useless in any size because they have a shelf life. And cash at scale can literally rot or get eaten by mice. Gold can be buried and it'll be there forever basically

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#24
post #5
post #2

Some cryptocurrency isn't a safe store of value to begin with, so he was probably ready to lose that at any moment anyways. Worse way than most to lose it, but he doesn't sound too bummed out.

>Some cryptocurrency isn't a safe store of value to begin with... If I may, I would posit all crypto is not a safe store of value to begin with. An EMP taking out the entire world power grid would render crypto pretty useless almost immediately, while gold will just sit there. Even paper money is resistant to decentralized unwindings as they are physical and people are conditioned from birth to accept their value.

Depends who holds the gold. Unless it's you, you're reliant on a list somewhere saying "person x owns y amount of the gold".

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#26
post #5
post #2

Some cryptocurrency isn't a safe store of value to begin with, so he was probably ready to lose that at any moment anyways. Worse way than most to lose it, but he doesn't sound too bummed out.

>Some cryptocurrency isn't a safe store of value to begin with... If I may, I would posit all crypto is not a safe store of value to begin with. An EMP taking out the entire world power grid would render crypto pretty useless almost immediately, while gold will just sit there. Even paper money is resistant to decentralized unwindings as they are physical and people are conditioned from birth to accept their value.

We have an end of the world scenario in this case, "money" in form of paper or metal won't have any value whatsoever then. Money in itself only has value if people trust the value of the system, which is given for example in Bitcoin.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#27

Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? Edit: and what’s the best practice here? Is it using a key management system of some sort? (I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API)

It is, if you know what you are doing.

@your edit: you can use environment variables for example, just don't commit your dotfile or just don't store in the same folder as the repo if you don't know what a dotfile is.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#28

Earlier quoted context omitted.

An EMP taking out the entire world power grid would be a complete disaster for everyone. Goldbugs and people with cash in their mattresses included.

I don't disagree with you that it would be a disaster, I'm just saying that fundamentally crypto is not a store of value. But don't listen to me, I only deliberately burned my early Bitcoin after evaluating it on its merits, weeks after it came out. Nothing, repeat nothing, has ever moved the needle on my opinion of crypto, although I will say that cryptobros will not stop at anything to try and convince people that…

In that scenario, people still need a medium of exchange. Physical medium of exchange such as precious metal and paper currency will still be more reliable than crypto or anything digital. The countries who are enforcing digital currencies are just digging their own graves when a Carrington level of event (or EMP) hits.

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#29

Genuine question here: isn’t it a standard security practice to avoid committing keys (or other secrets) to repos? Edit: and what’s the best practice here? Is it using a key management system of some sort? (I’m thinking of scenarios where you might need to deploy your code + secrets on a remote server, say to authenticate with a third party API)

Usually the simplest way is leveraging environment variables. You can set the API key as one on the remote server, then you can get it with `API_KEY = os.environ.get("API_KEY")`. That's a Python-specific example - but hopefully you get the idea.

There are other services that manage securely saving/storing these keys rather than just hosting it on the server itself (e.g. AWS Secrets Manager)

Re: Developer posts secret key on GitHub, loses $40K in 2 minutes

#30
post #26
post #5

Earlier quoted context omitted.

>Some cryptocurrency isn't a safe store of value to begin with... If I may, I would posit all crypto is not a safe store of value to begin with. An EMP taking out the entire world power grid would render crypto pretty useless almost immediately, while gold will just sit there. Even paper money is resistant to decentralized unwindings as they are physical and people are conditioned from birth to accept their value.

We have an end of the world scenario in this case, "money" in form of paper or metal won't have any value whatsoever then. Money in itself only has value if people trust the value of the system, which is given for example in Bitcoin.

>people trust the value of the system, which is given for example in Bitcoin.

It is in fact not a given(I for one do not trust the value of bitcoin or other cryptos, and I know more people who don't believe crypto has any value than those who do), and your comment is an example of attempting to coerce public opinions and beliefs in such a way as to promote crypto.

Post reply on HN