4 ms·
This makes me wonder what kind of practice change would be best to help avoid this sort of thing. Maybe anytime you put in something that you know is hacky and
by ufmace 13y ago
This makes me wonder what kind of practice change would be best to help avoid this sort of thing. Maybe anytime you put in something that you know is hacky and insecure as a one-off, you should put a note in wherever you would look regularly, and maybe some kind of reminder too, to make sure that your one-off is either removed or properly secured reasonably quickly.
Or maybe just a rant on PHP and/or frameworks that make it easy to do the wrong thing, and hard or time-consuming to do the right thing.
- jaryd 13y agoLooks like a good opportunity for an open source tool that scans a git repository for interesting/private information. Obviously it could be used for nefarious purposes, but it would be helpful for anyone looking to open source an existing repo. Another alternative is to store credentials in environment variables :)
- moot 13y ago> Looks like a good opportunity for an open source tool that scans a git repository for interesting/private information. These already exist in droves, which is exactly how our Amazon credentials were found. http://www.itnews.com.au/News/375785,aws-urges-developers-to-scrub-github-of-secret-keys.aspx http://www.itnews.com.au/News/375785,aws-urges-developers-to...
- jdhendrickson 13y agoI wasn't cognizant of the need to include a step in which you scan your own repo, just as a fail safe. So thanks for posting this.
- ufmace 13y agoProbably a good practice. For my current project, I've been careful to never commit any API credentials or other secrets to the repo, even though I don't currently have any intention of making it public. It's harder to know what you're missing, though.
- yeukhon 13y agoTime for this question to come back live. http://security.stackexchange.com/questions/56911/does-anyone-know-the-website-that-checks-passwords-committed-in-public-source-co http://security.stackexchange.com/questions/56911/does-anyon... Anyone has any idea about this website I am trying to find?
- cycojesus 13y agoHow about a commit hook that warns when it looks like you're about to commit a secret key?
- moot 13y agoSounds like a good plan to me!
- Mikushi 13y agoDid something similar, just built a module for our CI tool that checks against sensitive information (secret, salts, hashs, hidden feature), pretty efficient as every dev (myself included) can get lazy and use keys directly in scripts, instead of our Config loader that safely retrieves all that. Not bad in itself, sometimes all you need is a dirty script, but as other have said, they tend to stick around, a key part of our CI module is actually putting expire date on scripts, or check dates. I will receive an email telling me to check and a warning on the CI at build time. It's been great to keep our code clean while allowing us to still do things dirty when required.