5 ms·
They don't include command line arguments (yet). They include the command verb (dotnet [build/restore/etc]) that was ran.
by lightbyte 9y ago
They don't include command line arguments (yet). They include the command verb (dotnet [build/restore/etc]) that was ran.
- 0x0 9y agoWell, it looks like they are including "command verbs" even if they are mistyped, for example "bulid". What happens if you accidentally paste an AWS secret key or similar in the middle of a command verb? Will that too appear in public csv files a year later?
- runfaster2000 9y agoSee my comment to the grandparent comment on our approach to only including common command strings (which wouldn't include anyone's AWS key). Also, and more importantly, we will only collect known arguments. From the blog post: > Only known arguments and options will be collected (not arbitrary strings). We don't want your AWS secret key in this data as much as you do. We have put systematic mitigations in place to ensure that this doesn't happen.