4 ms·
Looks good. Hopefully someone will write something to automagically search for unintentionally exposed sensitive files and notify the repo owner - when the "hum
by JosephRedfern 13y ago
Looks good. Hopefully someone will write something to automagically search for unintentionally exposed sensitive files and notify the repo owner - when the "human" version of Code Search came out, a lot of private keys and other such things were discovered.
- negrit 13y agoPlease someone code it.
- beaumartinez 13y agoThe other possibility is that someone creates a malicious service that harvests and tries connecting using those keys. Scary indeed.
- bfish510 13y agoPeople leave private keys in repos all the time. I'm pretty sure this talk goes over it pretty well. https://www.youtube.com/watch?v=AwUJ9vpR7Vg https://www.youtube.com/watch?v=AwUJ9vpR7Vg
- eli 13y agoI'm not sure I want automated bots contacting me through github.
- ihsw 13y agoWhy not? Serious question.
- eli 13y agoWhen I searched Github it seemed like most of the supposedly leaked passwords were actually examples or placeholders and not a problem. It would be one thing if Github ran (or at least sanctioned) a feature that warned you of possible security problems, but I don't think I'd like potentially multiple, poorly-coded bots going around messaging repo owners.
- JosephRedfern 13y agoEven if it's letting you know your id_rsa file and ~/.ssh/config is exposed? I know I'd want to know...
- extempo 13y agoMalicious bots don't care if there is an API. They can screen scrape easily.
- eli 13y agoI'm sure malicious bots do try to mass message repository owners through Github. It's called spam and every platform over a certain size experiences it. I expect Github already has measures in place to block it.