Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IntelliJ GitHub Plugin leaking credentials

blog.jetbrains.com

Post reply on HN
Print view View original

21–26 of 26 posts

Re: IntelliJ GitHub Plugin leaking credentials

#21

Post by EdwardDiego »

that_guy_iain wrote: post #16
refulgentis wrote: post #5

Earlier quoted context omitted.

I don't understand what you mean: a blog post was published on the 10th, you saw a link to it twice today, so "everyone" took "so long to notice"? I'm teasing, it's just a surprisingly increasing fallacy I see: "Why is the rate at which I saw things not the rate I expect? What did They mean by this?"

Well considering the amount I’m on here, Reddit, and various tech slacks seeing something like this repeatedly normally means it’s just been posted. I’m kinda wondering if they didn’t do the usual promotion.

Obviously Big Kotlin is suppressing the news.

Re: IntelliJ GitHub Plugin leaking credentials

#22

Post by bdhcuidbebe »

refulgentis wrote: post #5
that_guy_iain wrote: post #2

This is the second time today I’ve seen this but it is dated the 10th how come it’s taken everyone so long to notice?

I don't understand what you mean: a blog post was published on the 10th, you saw a link to it twice today, so "everyone" took "so long to notice"? I'm teasing, it's just a surprisingly increasing fallacy I see: "Why is the rate at which I saw things not the rate I expect? What did They mean by this?"

> I'm teasing, it's just a surprisingly increasing fallacy I see: "Why is the rate at which I saw things not the rate I expect? What did They mean by this?"

Indeed, I have been noticing this form of fallacity lately too. it pops up everywhere. It seems to be related to the recent trend of boldly stating opinions about anything, without having any domain knowledge, which seem to have been popularized by a certain orange.

Re: IntelliJ GitHub Plugin leaking credentials

#23

Post by lyu07282 »

mattjaynes wrote: post #7

I have a client who was using JetBrains' TeamCity CI product. Was a clown show of vulnerabilities that allowed attackers access to internals. Do not use their products. If you must for some reason, be sure you subscribe to critical CVEs of the products you are using and update them immediately and rotate your credentials. Ideally re-install on a fresh server. Never have the service available via the public web, it wi…

I kind of have to agree but their software products are huge, it's difficult to say if they are particularly bad. Don't expose their products on the open web is good advice but it applies to many products not just theirs (like gitlab/gitea).

https://stack.watch/product/jetbrains/

Re: IntelliJ GitHub Plugin leaking credentials

#24

Post by WorldMaker »

thund wrote: post #15
stuff4ben wrote: post #4

Good idea to rotate your tokens on a regular basis, but in this case, go ahead and do it now (if you use this tool and plugin)

better even, don’t use never-expiring tokens/credentials that need rotation.

Expiration is still a form of rotation. Also, GitHub doesn't provide never-expiring tokens, all of their tokens have expiration policies and need regular rotation. That doesn't mean that there aren't good reasons (such as in this case vulnerable applications) to manually rotate even before the expiration date.

Re: IntelliJ GitHub Plugin leaking credentials

#25

Post by [deleted] »

albert_e wrote: post #17

Off topic -- how does the JetBrains website display "IntelliJ" text in stylized "iJ" at the end of IntelliJ? Some CSS magic? I tried editing the text using the developer tools and this styling only applies when the text is IntelliJ or any word that starts with this exact string (case sensitive)

[deleted]

Re: IntelliJ GitHub Plugin leaking credentials

#26

Post by paulryanrogers »

WorldMaker wrote: post #24
thund wrote: post #15

Earlier quoted context omitted.

better even, don’t use never-expiring tokens/credentials that need rotation.

Expiration is still a form of rotation. Also, GitHub doesn't provide never-expiring tokens, all of their tokens have expiration policies and need regular rotation. That doesn't mean that there aren't good reasons (such as in this case vulnerable applications) to manually rotate even before the expiration date.

IIRC, GH classic tokens can never expire.
Post reply on HN