3 ms·

How would git know that it's a password/key/whatever?

• diesal11 10y ago
  just make it search for files or variable assignments named "password" or "secret". That will catch the majority. In comparison Gmail doesn't catch all cases either, if you say something like "here are" instead of I've attached it misses it.
• aaron695 10y ago
  Key is easy. The high entropy should tip you off. Passwords, look for variables with the name password, passwd assigned strings. Like Gmails attachment, it'll get stuff wrong, just make it easy to continue on.
  • tuxxy 10y ago
    This. However, it would only work with secure passwords. Setting the entropy count too low would result in a bunch of false positives.
• epalm 10y ago
  I believe Django's logging framework will automatically replace strings in your settings.py file (basically a dict) with '*' if the key "looks like" a secret (contains the word 'secret' or 'key' or 'passw' etc).
• chiefalchemist 10y ago
  What would I do? I'd take ALL those incidents on GitHub and I'd run them thru some sort of AI pattern recognition algorithm. That would become my identification "engine" (?). It might not catch everything all the time - since humans are pretty creative when it comes to fucking things up - but I bet it would be pretty effective. Certainly more effective than what we have now. Then if it can keep learning going forward, all the better, eh.