How a bug in VS2015 exposed my source code on GitHub and cost me $6,500

Re:How a bug in VS2015 exposed my source code on GitHub and ... by ProAm on Monday August 31, 2015 @06:09PM (#10149390)

Why? It sounded like he is very security conscious. Thought he was creating a private repo in VS, immediately after he was notified deleted and recreated his keys. A pretty spot on course of action I think.

[ Parent | on HN ]

Re:How a bug in VS2015 exposed my source code on GitHub and ... by cptnbob on Monday August 31, 2015 @06:30PM (#10149512)

1. He stored credentials in source control rather than using configuration profiles as specified in the AWS SDK documentation.

2. He pushed code to a new repository without verifying the security configuration of the created repository (granted the tool made it easy to do this but you should create a repo, verify it, then push code).

3. He used his master AWS account key/secret in the code which gave global access to everything.

4. He didn't use IAM credentials with a restrictive policy set to just access the resources required.

No, clearly not security concious.

I'm a solution architect in the financial services industry and have been for 16 years. Never do I assume I know what the hell I'm doing.

[ Parent | on HN ]

Re:How a bug in VS2015 exposed my source code on GitHub and ... by famousactress on Monday August 31, 2015 @06:12PM (#10149412)

Because anyone who ever says "I didn't think it was possible that I could be the victim of a data breach" is dangerously delusional, and in case I'm not being clear - wrong.

Also putting keys in (even a private) cloud-hosted repos is at least a step under what I'd describe as "very security conscious" for someone who self describes as working in the financial industry.

[ Parent | on HN ]