5 ms·

I recall a newbie dev at our company some years back accidentally posted creds in code to github. I have talked about this here before - but - we had paid for 2

I recall a newbie dev at our company some years back accidentally posted creds in code to github. I have talked about this here before - but - we had paid for 200 repos.. problem was he made a new repo, which became 201 - which since we had only paid for 200, github auto makes the next one public. Bots slurp these and hunt... They used those creds to launch like 1700 gpu machines across the globe for a bitcoin mining network... The culprit was from germany... We got it cleared and AWS forgave all the charges.

scarface74 7y ago
It doesn’t matter. There is never a reason for credentials to be anywhere near your repository. If you’re running locally, you should have your credentials in your home directory (via aws configure). If you are running your code on AWS either on an EC2 instance, lambda, or Docker you should be using the role associated with the execution environment. Every SDK that I have used let’s you use a constructor without a parameter and can get your credentials from the config file/role.
- samstave 7y ago
  i know, this was a few years ago, and these types of practices were still being developed out in the greater community (lambda didnt exist yet, dockeer was still nascient etc)
  - acdha 7y ago
    I’m sympathetic in that a lot of people started learning this on the fly but that was widely recognized as bad practice even before Amazon was founded and various patterns for doing it right were widely established. (If anyone needs me, I’m busy feeling old after remembering having this conversation with a new PHP developer in 1998)
    - samstave 7y ago
      Haha, agreed... He was a remote worker and aparently had a poor handler on our end. I was head of ops not in dev, so i just had to deal with the fallout.