My advice: USE PRIVATE REPOS! At $7/month Github's micro plan with 5 repos is just $1.40/repo-month. This is the cheapest insurance you can get against the nearly inevitable mistake of committing something sensitive.
Why Deleting Sensitive Information from GitHub Doesn't Save You
41–50 of 91 posts
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#42Earlier quoted context omitted.
But that's my point. It's not basic because it's so context dependent (hence the comment about the regex/functions). No matter how clever you get with your pattern matching, you're going to have to always play catch-up with Web Framework N+1's format / weird-ass package manager. The dual approach is the only sensible approach because it expands your coverage. The important thing to this is to internalize the knowledg…
If only github had a community of developers that could play such a catch up game... oh wait. It's kind of amusing you are arguing that it's impossible to play this game, even though that's exactly what the perpetrators are doing, they are automatically detecting API keys and harvesting the code... maybe their script is hosted on github?
My point in my OP was to not play the game of catch-up, don't even pitch in your vuln strs.
Any time you want to show me a 100% future-proof algorithm for sensitive-info detection that works across any/all code on github, I'd be happy to toss my hat in and say, "I was wrong", until then, people will never ever beat 0days they don't know exist (0day being more than just a SW exploit). Just do.not.commit.sensitive.info.to.github. Period. That is the only sure way to not mess it up. Software only executes what is in the code, regardless of how nonsensical it is (aka, your code will not save you from messing up, something something something, PEBKAC)
I'm not arguing it's "impossible to play this game" It's 100% possible to play it when and how you'd like. I'm discussing the rate of "did I win (read: not get pwnd)?" It's cat and mouse of automation for vulnerable/sensitive info ... but all of that is rendered moot if you ... wait for it ... don't commit it to Github which would mean it wouldn't get to Github's API which means it wouldn't appear in 3rd party services sucking the firehose from Github cloud-y silicon teet.
And expanding on this ... committing your passwords and sensitive info to your code-repo is so misguided it's actually funny. What happens if you have an employee and they go off the deep end? Whoops, gotta rotate all those passwords/credentials/un-fuck every branch/resync dev's machines/etc. Keeping that sensitive info in a private, self-hosted, well-maintained internal repo (with strong ACLs, especially wrt server/hosting environments) will go significantly further for your team's security than submitting a feature request to a company to stop you from making arbitrary mistakes every so often.
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#43Github has very good cache. In the past, when I deleted a repository I still was able to access some diff and commit information from my own activity pages. I had to request Github team to clear that page manually.
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#44My advice: USE PRIVATE REPOS! At $7/month Github's micro plan with 5 repos is just $1.40/repo-month. This is the cheapest insurance you can get against the nearly inevitable mistake of committing something sensitive.
Could also have a look at BitBucket instead: unlimited private personal (or teams of max 5) repos at $0/month. Or for $7/month you can host your own at DigitalOcean/Azure/...
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#45> In this post, I’m going to show exactly how hackers instantly harvest information committed to public Github repositories... A few days ago I published my blog to GitHub, with my MailGun API key in the config file (stupid mistake, I know). In less than 12 hours, spammers had harvested the key AND sent a few thousand emails with my account, using my entire monthly limit. Thankfully I was using the free MailGun accou…
I had a similar but less pleasant experience. I had decided to opensource an old side project of mine, that gets a good amount of users daily. And by that, it was just initially to make the repo public. But I had totally forgot about the mail server keys- this was a paid mail server, so you can imagine my disbelief when I get an email of a $1000 bill and a complaint saying that I had sent upwards of 250k emails with…
I'm curious. Did they excuse the bill or was this a $1000 lesson?
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#46There's a fairly straight forward pattern for keeping sensitive credentials out of github. It comes straight from http://12factor.net/config store configuration data in the environment. What I do for most projects is keep the tree containing the working directory in a directory that has some other items that don't belong on github (like the project brief, my emacs bookmarks file, random notes related to the project e…
If you're feeling fancy, you can use my library to asymmetrically encrypt credentials using RSA keys [1].
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#47Earlier quoted context omitted.
Environment variables can work well for development but I wouldn't put them in .bashrc or .bash_profile; if you are like me, you like to store your dot files somewhere public. I typically leave them in an encrypted file on dev systems, but this only solves the accidental over the shoulder problem. Production systems require another level of security altogether. Typically, I've seen services run in restricted user acc…
> if you are like me, you like to store your dot files somewhere public. In your public .bashrc, put a line "source .bashrc.secret." Just keep an empty .bashrc.secret in your public repository, and keep your actual secret credential on your machines.
And don't forget to add it to .gitignore, otherwise when overwritten accidently it might land in public repo.
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#48My advice: USE PRIVATE REPOS! At $7/month Github's micro plan with 5 repos is just $1.40/repo-month. This is the cheapest insurance you can get against the nearly inevitable mistake of committing something sensitive.
Sure, use private repos for private projects but this is about open-source authors accidentally leaving their credentials in config files and the like.
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#49[deleted]
Re: Why Deleting Sensitive Information from GitHub Doesn't Save You
#50I think this problem is widespread enough and there are enough idiots out there(me included),that there should be a feature request for Github to provide a prompt in case Github detects sensitive information in the code hosted.
Similarly, a white hat could watch /events and warn users and/or services when credentials are 'burned'. (A major exploitable service like AWS might even want to do this itself.)
AWS actually does that already — they'll ping you by email if they find one of your keys on GitHub!