3 ms·
It's actually GitHub that contacts AWS even before the commit finishes being sent to GitHub so it is indeed very fast.
by Znafon 6y ago
It's actually GitHub that contacts AWS even before the commit finishes being sent to GitHub so it is indeed very fast.
- paultopia 6y agoReally? If Github is already detecting credentials that reliably, I wonder why they don't just switch repositories to temporarily private and e-mail the account owner themselves...?
- netzvieh 6y agoBecause the key has to be revoked on AWS side, not just removed from the repo. And probably the person pushing to Github and the person paying the AWS bill/the AWS admin are usually not the same..
- thunderrabbit 6y agoOr at least display a confirmation box..
- Znafon 6y agoI don't think they do detection reliably, they have no idea whether it is an actual key or it could be a placeholder used as documentation for example. I don't know the details bit perhaps they just send it to AWS and AWS doesn't tell them whether it is an actual key or not?