4 ms·

Considering how often people commit their credentials, it seems Git or GitHub need a --i-need-a-nanny option that would check if you're about to publish things

Considering how often people commit their credentials, it seems Git or GitHub need a --i-need-a-nanny option that would check if you're about to publish things that you would not rather publish. But then it would have to be an installation option because the people who goof up like this would not know/remember to add that CLI parameter; but I would bet a lot of people would turn on said nanny option that would warn you if you're about to commit lines containing the word "password" or "secret" or "key" (obviously it would have to be more clever than this simple text compare, otherwise it would warn on lines like "function checkPassword(String userSuppliedPassword) {"...

ceejayoz 6y ago
Github already does this to some extent. https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/about-secret-scanning https://docs.github.com/en/free-pro-team@latest/github/admin...
eli 6y ago
There are lots of tools that do that. Obviously it’s always going to have false positives and false negatives. A dev environment that makes it easy to deal with secrets the right way is probably better
fjfaase 6y ago
There are also ways of using Git without a repository in the cloud. As a security oriented company, it seems a good policy to avoid using cloud services as much as possible.
SamBam 6y ago
GitHub already warns you if you accidentally check in an API key. It's like a rite of passage for new devs at my company setting up a new project. Then we have to walk them through changing the keys.
blntechie 6y ago
Someone in my company committed an AWS credential to GitHub public repo and AWS actually emailed within few hours saying that the access key has been deactivated or something alike. AWS seem to be scanning the public repos pretty actively for such instances.
- JackFr 6y ago
  I've been stupid enough to commit AWS creds to Github twice. (At least twice?) The first time AWS emailed me within an hour. The second time about 20,000 French language spam emails were sent out and I only realized the issue when AWS suspended the credentials because of the bounce rate on the emails. Thankfully only ended up costing me a couple of bucks, but scared the hell out of me.
  - hackerpain 6y ago
    AWS now sends emails if you commit access keys, even better they are catching loads of other sensitive info having privileged access to the GitHub API. Cool and creepy at the same time, right?
mbag 6y ago
you could add those checks to pre-commit hooks. However, the problem with those hooks is that they need to be added locally by user. There are already modules/libraries with sets of regexes that are able to perform filtering you are suggesting. Another option is to use pipeline to perform those checks. Sure, by the time pipeline runs, the secrets are already in the repository, but at least you caught them early. However, in this case you should definitively do secrets replacement.

ceejayoz 6y ago

Github already does this to some extent. https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/about-secret-scanning https://docs.github.com/en/free-pro-team@latest/github/admin...

eli 6y ago

There are lots of tools that do that. Obviously it’s always going to have false positives and false negatives. A dev environment that makes it easy to deal with secrets the right way is probably better

fjfaase 6y ago

There are also ways of using Git without a repository in the cloud. As a security oriented company, it seems a good policy to avoid using cloud services as much as possible.

SamBam 6y ago

GitHub already warns you if you accidentally check in an API key. It's like a rite of passage for new devs at my company setting up a new project. Then we have to walk them through changing the keys.

blntechie 6y ago

Someone in my company committed an AWS credential to GitHub public repo and AWS actually emailed within few hours saying that the access key has been deactivated or something alike. AWS seem to be scanning the public repos pretty actively for such instances.

JackFr 6y ago
I've been stupid enough to commit AWS creds to Github twice. (At least twice?) The first time AWS emailed me within an hour. The second time about 20,000 French language spam emails were sent out and I only realized the issue when AWS suspended the credentials because of the bounce rate on the emails. Thankfully only ended up costing me a couple of bucks, but scared the hell out of me.
- hackerpain 6y ago
  AWS now sends emails if you commit access keys, even better they are catching loads of other sensitive info having privileged access to the GitHub API. Cool and creepy at the same time, right?

mbag 6y ago

you could add those checks to pre-commit hooks. However, the problem with those hooks is that they need to be added locally by user. There are already modules/libraries with sets of regexes that are able to perform filtering you are suggesting. Another option is to use pipeline to perform those checks. Sure, by the time pipeline runs, the secrets are already in the repository, but at least you caught them early. However, in this case you should definitively do secrets replacement.