3 ms·

How is it secured and made private?

• cratermoon 6y ago
  Found the code. Looks like basic auth. And, I can't find any password hashing -- are they being stored in the clear? Also the author checked in a credentials and a master key to github
  • hanniabu 6y ago
    Yikes, huge red flags....
  • mawise 6y ago
    I'm using Rails Devise[1] for user auth, and http basic auth for RSS. RSS Basic auth credentials are always auto-generated, and don't give access to anything other than fetching the RSS feed. Rails uses the "master key" to let you check in encrypted database credentials. I don't use that but Rails still requires a key for deployment--so I just checked in a key. Rails is really designed for a codebase that matches to a single deployment so this is a bit of a workaround. [1] https://github.com/heartcombo/devise https://github.com/heartcombo/devise
    • cratermoon 6y ago
      > I don't use that but Rails still requires a key for deployment--so I just checked in a key It's safe to bet that someone will deploy this and use that master key instead of generating their own.
  • jgjot-singh 6y ago
    How long did it take you to discern all that?