5 ms·

PM for GitHub Advanced Security here. We handle that with secret scanning - code scanning focusses on static analysis of your code to find vulnerabilities in y

PM for GitHub Advanced Security here. We handle that with secret scanning - code scanning focusses on static analysis of your code to find vulnerabilities in your code, rather than committed secrets. We have a partnership with AWS (and many other token issuers) that handles this really nicely. If anything that looks like an AWS credential is committed to a public repo we send it over to AWS - if it's a real token they notify the token's owner (and in some cases automatically revoke the key). There's full details at https://help.github.com/en/github/administering-a-repository/about-secret-scanning https://help.github.com/en/github/administering-a-repository....

lonelappde 6y ago
Please clarify who "we" is in your comments.
- greysteil 6y ago
  Done - thanks!
techntoke 6y ago
I too would like to know. > We have a partnership with AWS (and many other token issuers) that handles this really nicely. If anything that looks like an AWS credential is committed to a public repo we send it over to AWS - if it's a real token they notify the token's owner (and in some cases automatically revoke the key). So if something looks like a token from AWS or another token issuer, you automatically send the token to providers to check to see if it is "legit"? Is this something that is opt-in, or done automatically?
- nso 6y ago
  I don't really see what the problem with this would be. I'm assuming AWS does not give a "yeah looks like it", or "nah" response -- but rather "thanks, we will look into it" and then if it's a real one the rest is directly with their customer. That way no sensitive information would leak between the providers
  - techntoke 6y ago
    I personally don't want anyone sending my data to another provider without having me opt in first. I trust AWS to do the right thing as much as I trust Fox News to report the news accurately.
    - D2187645 6y ago
      If your keys are public they are free to anyone who wants it. They are also sending aws specific keys to amazon.
      - techntoke 6y ago
        Yes and no. I'm personally not so much worried about the keys, but whatever detection they are doing to send what they "think" might be a token/key/etc. And just because a key is public, doesn't mean that it is going to be automatically sent to a third-party. If you accidentally upload a key, but then immediately notice and force push, you're already too late since GitHub took the initiative to share that. I get that the user would be at fault here ultimately, but that doesn't mean that GitHub should be working against the user in sharing that. What if it isn't an AWS token, but instead an encryption key or SSH key that you have blocked off to the public so you're not too worried about it but you're a warehouse worker protesting COVID-19 treatment. Now Jeff Bezos will be looking for dirt on you like you're Michael Sanchez. If they made the detection information public then it would at least provide some transparency to see what they determine to be AWS-specific.
        KMag 6y ago
        > SSH key that you have blocked off to the public so you're not too worried about it How do you "block off to the public" something committed to a public GitHub repository? The OP specifically said this was for public repositories. If GitHub weren't doing this, I imagine the AWS security people would be crawling GitHub on their own, to cut down on security incidents. This push mechanism just makes it more efficient for both GitHub and AWS. If Amazon is looking for dirt on you, and you have public repositories, you can bet they'll be looking deeper into your repositories than a quick credential scan.

lonelappde 6y ago

Please clarify who "we" is in your comments.

greysteil 6y ago
Done - thanks!

techntoke 6y ago

I too would like to know. > We have a partnership with AWS (and many other token issuers) that handles this really nicely. If anything that looks like an AWS credential is committed to a public repo we send it over to AWS - if it's a real token they notify the token's owner (and in some cases automatically revoke the key). So if something looks like a token from AWS or another token issuer, you automatically send the token to providers to check to see if it is "legit"? Is this something that is opt-in, or done automatically?

nso 6y ago
I don't really see what the problem with this would be. I'm assuming AWS does not give a "yeah looks like it", or "nah" response -- but rather "thanks, we will look into it" and then if it's a real one the rest is directly with their customer. That way no sensitive information would leak between the providers
- techntoke 6y ago
  I personally don't want anyone sending my data to another provider without having me opt in first. I trust AWS to do the right thing as much as I trust Fox News to report the news accurately.
  - D2187645 6y ago
    If your keys are public they are free to anyone who wants it. They are also sending aws specific keys to amazon.
    - techntoke 6y ago
      Yes and no. I'm personally not so much worried about the keys, but whatever detection they are doing to send what they "think" might be a token/key/etc. And just because a key is public, doesn't mean that it is going to be automatically sent to a third-party. If you accidentally upload a key, but then immediately notice and force push, you're already too late since GitHub took the initiative to share that. I get that the user would be at fault here ultimately, but that doesn't mean that GitHub should be working against the user in sharing that. What if it isn't an AWS token, but instead an encryption key or SSH key that you have blocked off to the public so you're not too worried about it but you're a warehouse worker protesting COVID-19 treatment. Now Jeff Bezos will be looking for dirt on you like you're Michael Sanchez. If they made the detection information public then it would at least provide some transparency to see what they determine to be AWS-specific.
      - KMag 6y ago
        > SSH key that you have blocked off to the public so you're not too worried about it How do you "block off to the public" something committed to a public GitHub repository? The OP specifically said this was for public repositories. If GitHub weren't doing this, I imagine the AWS security people would be crawling GitHub on their own, to cut down on security incidents. This push mechanism just makes it more efficient for both GitHub and AWS. If Amazon is looking for dirt on you, and you have public repositories, you can bet they'll be looking deeper into your repositories than a quick credential scan.