News for hackers. Stuff that matters.

A comment on Survey of popular Node.js packages reveals credential leaks. Parent comment

Re:Survey of popular Node.js packages reveals credential leaks by 0x0 on Sunday December 06, 2015 @05:42PM (#10687018)
That's pretty sweet, but by then the damage's already done. Rejecting the push would be even better, making sure the confidential data never goes public. AIUI dark-hatted people are scraping the real-time push feeds at Github for credentials and botting up exploits, so even a few seconds could be a big enough window for damage to be done.

An example of this happening on AWS just like you mentioned: https://www.humankode.com/security/how-a-bug-in-visual-studi...

[ Parent | on HN ]
Re:Survey of popular Node.js packages reveals credential leaks by fapjacks on Sunday December 06, 2015 @06:49PM (#10687273)
I was just thinking of this exact story when the grandparent mentioned AWS. They have a huge financial interest in automatically detecting this kind of thing.
[ Parent | on HN ]
Re:Survey of popular Node.js packages reveals credential leaks by thedufer on Sunday December 06, 2015 @08:44PM (#10687620)
I mean, obviously AWS can't reject your pushes, so it's the best they can do, but I agree that it would be nice if Github did this as well.

> That's pretty sweet, but by then the damage's already done.

I'm not sure that's true. I was able to disable the key before anyone used it (although it was locked down so far that they couldn't have charged anything to my account, since I didn't trust the code I was testing with real money).

[ Parent | on HN ]