lumberjack24
Joined 6 years ago
Karma
38
Submissions
51
Member since
May 21
@ GitGuardian
View on Hacker NewsRecent submissions
Comment · 3 years ago
Forest Admin's out-of-the-box admin panel + the convenience of the cloud, this is all developers ever wanted for their internal tools!
Comment · 3 years ago
To Casablanca, Morocco.
Comment · 3 years ago
Hey, maybe try running a GitGuardian [1] scan on all those repositories to look for hardcoded secrets. GitGuardian can also test in some cases if the secrets are valid or not, meaning you have to revoke and rotate them asap. I hope this helps.
[1] https://www.gitguardian.com/monitor-internal-repositories-fo...
Disclaimer: I work for GitGuardian.
Comment · 3 years ago
geez.
Comment · 4 years ago
“dark matter” sounds like marketing speak.
Comment · 4 years ago
well, they haven’t turned my building’s heating on yet.
Comment · 4 years ago
Here's a checklist [1] (again, from gitguardian) of steps to follow before open-sourcing projects and [2] a guide on how to remediate hardcoded/exposed secrets.
[1] https://blog.gitguardian.com/safely-open-source-software-bes... [2] https://blog.gitguardian.com/leaking-secrets-on-github-what-...
Comment · 4 years ago
Great idea, but hard to enforce. Just use a scanning CLI like TruffleHog, Gitleaks, or ggshield from GitGuardian to catch all sorts of hardcoded secrets.
Comment · 4 years ago
GitGuardian actually does this, it monitors an extended perimeter of devs and their personal/open-source repos for corporate secrets or keywords – https://www.gitguardian.com/monitor-public-github-for-secret...
Comment · 4 years ago
In the meantime, try ggshield cli https://github.com/GitGuardian/ggshield
Comment · 4 years ago
The access model on platforms like GitHub is flawed, a single account can be used for both professional and personal projects/repositories, leading to “fat finger” errors like this one here...
Comment · 4 years ago
I can’t help but wonder why qursān ended up being the final form instead of qursāl.
Comment · 4 years ago
That hardcoded secret in the powershell script really was the key to the Uber ride-hailing kingdom – https://blog.gitguardian.com/uber-breach-2022.
Comment · 4 years ago
open to referrals?