4 ms·

Another red flag is that they should mention what they will do with clear-text credentials that are in the source code that was stolen. There are always creds

by kerng 4y ago

Another red flag is that they should mention what they will do with clear-text credentials that are in the source code that was stolen. There are always creds in private/company repos! Lots.

chunk_waffle 4y ago
> There are always creds in private/company repos! Lots. I disagree with the "always" in this statement. Sloppy, lazy private repos sure. It is possible to have them completely absent in any and all repos though I've only seen and been part of such an effort once, it takes a lot of work to make sure it happens and I have little faith in most companies following through with that.
- TechBro8615 4y ago
  In my experience it's a pretty low bar to keep private credentials outside of source code. If a "security" company like Okta has secrets in their source code, that's embarrassing and unexpected. Any competent team of 2+ developers should be able to avoid this. However, what's more common is secrets in CI variables. If their GitHub was breached, they should be more concerned with whether the attackers had access to GitHub Actions logs or secrets.
nobleach 4y ago
In this day and age, I really do not understand why one of the first steps when spinning up a new repo (for this type of app) is not leveraging a tool like dotenv, and then a config system that uses environment variables for things like db credentials/etc. Yes it takes another hour of time to get that all going but, in the long run, you'll thank yourself! I've worked in places where all the code was open to all teams, with the exception of DevOps because they had too many hardcoded secrets and never had time to clean up their mess. I get it, they really were spread thin... but it should have never happened in the first place.
madcadmium 4y ago
Okta employee here. I can assure you that there are no clear-text credentials in our source code.
- deleted 4y ago
  [deleted]

by kerng 4y ago

Another red flag is that they should mention what they will do with clear-text credentials that are in the source code that was stolen. There are always creds in private/company repos! Lots.

chunk_waffle 4y ago

> There are always creds in private/company repos! Lots. I disagree with the "always" in this statement. Sloppy, lazy private repos sure. It is possible to have them completely absent in any and all repos though I've only seen and been part of such an effort once, it takes a lot of work to make sure it happens and I have little faith in most companies following through with that.

TechBro8615 4y ago
In my experience it's a pretty low bar to keep private credentials outside of source code. If a "security" company like Okta has secrets in their source code, that's embarrassing and unexpected. Any competent team of 2+ developers should be able to avoid this. However, what's more common is secrets in CI variables. If their GitHub was breached, they should be more concerned with whether the attackers had access to GitHub Actions logs or secrets.

nobleach 4y ago

In this day and age, I really do not understand why one of the first steps when spinning up a new repo (for this type of app) is not leveraging a tool like dotenv, and then a config system that uses environment variables for things like db credentials/etc. Yes it takes another hour of time to get that all going but, in the long run, you'll thank yourself! I've worked in places where all the code was open to all teams, with the exception of DevOps because they had too many hardcoded secrets and never had time to clean up their mess. I get it, they really were spread thin... but it should have never happened in the first place.

madcadmium 4y ago

Okta employee here. I can assure you that there are no clear-text credentials in our source code.

deleted 4y ago
[deleted]