2 ms·
Travis CI flaw exposed secrets of thousands of open source projects
- geerlingguy 5y agoWonderful; at least I've moved 99% of my projects off Travis CI to GitHub Actions by now. I still always use separate credentials for CI systems so I can rotate them quickly in the event of a leak. But environment secrets are one of the few things that a CI system kind of _has_ to do perfect, otherwise all bets are off.
- rurp 5y ago> Felix Lange found a security vulnerability that caused Travis CI to include secure environment variables of all public open source repositories that use Travis CI into pull request (PR) builds. This is really bad. The most frustrating part is how predictable Travis CI's decline is, after having been bought by a private equity group. As many people on HN and elsewhere predicted, the days of Travis CI providing a quality service were numbered after being bought by Idera.
- Matthias1 5y agoDiscussions from earlier today: https://news.ycombinator.com/item?id=28523350 https://news.ycombinator.com/item?id=28523350 https://news.ycombinator.com/item?id=28524727 https://news.ycombinator.com/item?id=28524727