4 ms·
Better than it being exposed to the entire world Also I feel fairly confident Github/MS aren't about to change their business model to become a blackhat hackin
by nickelpro 3y ago
Better than it being exposed to the entire world
Also I feel fairly confident Github/MS aren't about to change their business model to become a blackhat hacking collective
- darthbanane 3y agoYeah definitely better than allowing the push. But I feel they should also at least recommend rotating the secret
- minedwiz 3y agoMy team checked out the similar thing they're pushing in ADO (https://learn.microsoft.com/en-us/azure/defender-for-cloud/azure-devops-extension https://learn.microsoft.com/en-us/azure/defender-for-cloud/a...). The messages from that thing do tell you to rotate, though AFAIK not having looked that far into it just breaks the build, not proactive push detection.
- 7znwjshsus 3y agoThat's not the risk. The risk is that Github has lackluster permissions and audit trailing and an employee could leak and sell keys. Or that they log keys and someone hacks their logs. Rotating the secret is 100% the correct thing to do in this case.
- prepend 3y agoI’m not that worried about this. I mean, Microsoft runs azure and they have security protocols, that you can audit and show to your auditors, that reduce the risk of sysadmins snooping on vms, blob storage and anything else they could scan for keys. I think the risk of a GitHub employee introducing malicious code to scan memory and dump any tokens found for exhilaration is lower than the risk of my own employee or myself doing that. Rotating the secret seems like a waste of resources in this situation.