Show HN: GitMonKey – monitor your repos and commits for exposed private keys • Hacker News Board

Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#1

Post by shaharsol » Thu, Apr 20, 2017, 12:07 PM UTC

Show HN: GitMonKey – monitor your repos and commits for exposed private keys
gitmonkey.io

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#2

Post by DINKDINK » Thu, Apr 20, 2017, 12:34 PM UTC

It seems this should be a standard product offering for GitHub

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#3

Post by dberg » Thu, Apr 20, 2017, 12:35 PM UTC

DINKDINK wrote: post #2

It seems this should be a standard product offering for GitHub

Agreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#4

Post by shaharsol » Thu, Apr 20, 2017, 12:37 PM UTC

DINKDINK wrote: post #2

It seems this should be a standard product offering for GitHub

Github does this actually but only from github access tokens generated from their API... if you generate an oauth access token and commit it, they will automatically revoke it.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#5

Post by shaharsol » Thu, Apr 20, 2017, 12:38 PM UTC

dberg wrote: post #3

DINKDINK wrote: post #2

It seems this should be a standard product offering for GitHub

Agreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.

There are git hooks that u can run locally, but think as a manager of an R&D team of 10-20 developers. You need to make it centralised.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#6

Post by fredley » Thu, Apr 20, 2017, 12:38 PM UTC

dberg wrote: post #3

DINKDINK wrote: post #2

It seems this should be a standard product offering for GitHub

Agreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.

Yeah, what if gitmonkey accidentally reveal a secret key? Now somebody has a curated list of everyone's git's secret keys - even the ones in private repos!

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#7

Post by sevagh » Thu, Apr 20, 2017, 12:40 PM UTC

How about this one? https://github.com/dxa4481/truffleHog

Posted here a few months ago.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#8

Post by jwilk » Thu, Apr 20, 2017, 12:40 PM UTC

To see it with JS disabled, disable also CSS.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#9

Post by nailer » Thu, Apr 20, 2017, 12:45 PM UTC

Weirdly AWS and GitHub seems to have something similar. I know a couple of folks (not me!) who've uploaded AWS credentials to OSS projects on GitHub and been contacted by AWS about it, after AWS has revoked the credentials.

Re: Show HN: GitMonKey – monitor your repos and commits for exposed private keys

#10

Post by shaharsol » Thu, Apr 20, 2017, 12:47 PM UTC

nailer wrote: post #9

Weirdly AWS and GitHub seems to have something similar. I know a couple of folks (not me!) who've uploaded AWS credentials to OSS projects on GitHub and been contacted by AWS about it, after AWS has revoked the credentials.

I wonder if they scan GH periodically, or simply see abnormal action on these accounts that are accessed by the exposed keys.