4 ms·
Blaming github for people committing secrets to public repos sounds weird.
by SahAssar 5y ago
Blaming github for people committing secrets to public repos sounds weird.
- karmakaze 5y agoIt's not only weird, it's a dumb, shallow, misguided article. > Marlin speculates that the oversight is a consequence of committing code from one's Linux home directory.
- belter 5y agoFrom the article... > Marlin acknowledges that affected GitHub users deserve some blame for failing to prevent their cookies.sqlite databases from being included when they committed code and pushed it to their public repositories. "But there are nearly 4.5k hits for this dork, so I think GitHub has a duty of care as well,"
- SahAssar 5y agoDo you think that 4.5k hits means that they should have special rules for this? Or is there another argument for this that is not based on volume?
- belter 5y agoWhy did they do this then? https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning https://docs.github.com/en/code-security/secret-scanning/abo...
- SahAssar 5y agoThey have a way to deal with this, considering the original article either it is the fault of mozilla to not have a signature to submit to this list or it is the fault of users committing secrets to public repos. Either way it is not the fault of github IMO. In my mind it is mostly the fault of users.
- psanford 5y agoSecret scanning is done in partnership with third parties to detect and revoke api credentials. It is based on regexp matching and involves making a call to a webhook owned by the third party to revoke the secret. That doesn't work for arbitrary cookies.