4 ms·
An overlooked vector is old commits. It’s often times better to squash all commits before taking a project open source, which is a real shame for obvious reason
by ed25519FUUU 6y ago
An overlooked vector is old commits. It’s often times better to squash all commits before taking a project open source, which is a real shame for obvious reasons.
Commit histories can spill a lot of secrets that are easy to overlook.
- _the_inflator 6y agoAbsolutely this! Same problem here with inner source, that goes open source. I feel sorry for all our internal committers, however I know of "secrets", that went into the commit history. We are still considering our option, but tend to opt for deleting our commit history entirely and build a wall of fame for the former committers.
- psanford 6y agoThere are tools available to help look for this sort of thing (for both you and any potential attackers). TruffleHog[1] is the first one that comes to mind for me. I also like shhgit[2] for looking for secrets in repositories. (I don't think shhgit will look back in the git history for you though). [1]: https://github.com/dxa4481/truffleHog https://github.com/dxa4481/truffleHog [2]: https://github.com/eth0izzle/shhgit https://github.com/eth0izzle/shhgit
- amichal 6y agoThanks! I knew they existed but hadn't investigated for one that would look over past history. Will try out truffleHog.
- psanford 6y agoI've found the entropy detection in trufflehog to be pretty noisy. When I've run it I generally disable that.
- lstamour 6y agoAnother idea is to use a git commit hook, such as https://github.com/cloud-gov/caulking https://github.com/cloud-gov/caulking
- jgalt212 6y agoMy current fear is versioning back up systems. KeePass files may now have secure master keys, but maybe the version saved 18 mos ago did not. 1. Get an old copy 2. run dictionary attack 3. prosper