2 ms·
I'm dubious. Searching for globally unique commit IDs is still a least a million+ request operation. That's easy enough in a cryptographic sense but the attac
by ajross 2y ago
I'm dubious. Searching for globally unique commit IDs is still a least a million+ request operation. That's easy enough in a cryptographic sense but the attack in question requires banging a web UI, which is 100% for sure going to hit some abuse detector. I really don't think you can do this in practice, and the article certainly doesn't demonstrate it.
- infinite8s 2y agoThey released a tool to do this in a followup post: https://trufflesecurity.com/blog/trufflehog-now-finds-all-deleted-and-private-commits-on-github https://trufflesecurity.com/blog/trufflehog-now-finds-all-de...