51–60 of 91 posts
I think this problem is widespread enough and there are enough idiots out there(me included),that there should be a feature request for Github to provide a prompt in case Github detects sensitive information in the code hosted.
Earlier quoted context omitted.
> there should be a feature request for Github to provide a prompt in case Github detects sensitive information in the code hosted. Sure, just enumerate any and all possible types of sensitive data, the format they may be in, regex / matching functions to account for them (supported across 20+ programming languages) and I'm sure Github will have that done asap. Alternatively, don't commit passwords/API-keys/sensitive…
> Sure, just enumerate any and all possible types of sensitive data False dichotomy. It doesn't have to be "everything" or "nothing". An 80% solution here is better than nothing. I still find it useful that gmail warns me before I send an email without an attachment if I've written "I've attached" in an email. Can gmail detect with 100% accuracy if I intended to send an attachment? Of course not. But the 80% solution…
On windows I create a batch file at a fixed location with all the credentials in it. A script simply runs this batch file and reads the env cars to get values. A compiled program parses the batch file with regex to find required values. This works remarkably well for keeping credentials out of the code base.
Hope that hels someone.
Always use environment variables. They are probably the best way to safeguard your API keys.
I've always wondered the proper way to deal with this, and this makes total sense. How would you typically set such an environment variable? In bash init?
[1] http://cr.yp.to/daemontools/envdir.html [2] http://envdir.readthedocs.org/en/latest/
Millions of emails for developers and no one harvesting this info thought it wise to obfuscate it in some way?
Emails are part of commits, which are hashed as part of normal git operations. There's no way to make repositories public and not make emails public.
There's a fairly straight forward pattern for keeping sensitive credentials out of github. It comes straight from http://12factor.net/config store configuration data in the environment. What I do for most projects is keep the tree containing the working directory in a directory that has some other items that don't belong on github (like the project brief, my emacs bookmarks file, random notes related to the project e…
If you're feeling fancy, you can use my library to asymmetrically encrypt credentials using RSA keys [1]. [1]: https://github.com/jacobgreenleaf/greybox
Maybe the answer to these questions and others is satisfactory, but getting RSA catastrophically wrong is easy enough that I'm extremely skeptical that a library will get it right. Honestly, I'd be infinitely more likely to use your library if it just used GPG under the hood. That's one less piece of crypto I feel compelled to audit.
Earlier quoted context omitted.
> there should be a feature request for Github to provide a prompt in case Github detects sensitive information in the code hosted. Sure, just enumerate any and all possible types of sensitive data, the format they may be in, regex / matching functions to account for them (supported across 20+ programming languages) and I'm sure Github will have that done asap. Alternatively, don't commit passwords/API-keys/sensitive…
> Alternatively, don't commit passwords/API-keys/sensitive-info to your repo. This is, of course, the right answer. However, it's frustrating that several frameworks make this very easy to get wrong. Anything that has an application.yml, database.yml, or similar configuration file that normally lives within the same directory as the source code, and which is intended to contain credentials, means that lots of people…
I think this problem is widespread enough and there are enough idiots out there(me included),that there should be a feature request for Github to provide a prompt in case Github detects sensitive information in the code hosted.
My advice: USE PRIVATE REPOS! At $7/month Github's micro plan with 5 repos is just $1.40/repo-month. This is the cheapest insurance you can get against the nearly inevitable mistake of committing something sensitive.
Sure, use private repos for private projects but this is about open-source authors accidentally leaving their credentials in config files and the like.
Always use environment variables. They are probably the best way to safeguard your API keys.
I've always wondered the proper way to deal with this, and this makes total sense. How would you typically set such an environment variable? In bash init?