News for hackers. Stuff that matters.

A comment on GitHub commit search: “remove password”. Parent comment

Re:GitHub commit search: “remove password” by _pctq on Wednesday February 15, 2017 @06:14AM (#13651184)
And this would be a cool feature from github too. A link mentioning "we found something in your code that looks like a secret, please know people will use it."
[ Parent | on HN ]
Re:GitHub commit search: “remove password” by Klathmon on Wednesday February 15, 2017 @06:31AM (#13651261)
They do this for all of their own API keys already. They not only notify you but instantly invalidate a key pushed to a public repo.

Annoyingly there is no way to turn it off even when you explicitly want to share an API key knowingly. But i'm more than fine with needing to "obfuscate" an API key or manage secrets correctly knowing it saves TONS of people.

[ Parent | on HN ]
Re:GitHub commit search: “remove password” by chimeracoder on Wednesday February 15, 2017 @06:53AM (#13651349)
Why would you ever want to share a valid Github API key publicly?
[ Parent | on HN ]
Re:GitHub commit search: “remove password” by Klathmon on Wednesday February 15, 2017 @07:05AM (#13651409)
It's been a while, but IIRC it was a key with no permissions used on a CI server to get around github's API usage limits.

It probably wasn't the best idea, but it was the only "secret" needed in the whole project and I didn't want to maintain a way of managing secrets in a public project for a pointless key.

In the end I did just that, and looking back it was the better choice, but at the time it was annoying.

[ Parent | on HN ]
Re:GitHub commit search: “remove password” by Cyphase on Wednesday February 15, 2017 @08:46AM (#13651914)
"... used ... to get around github's API usage limits."

I wonder why they'd want to invalidate that. :)

[ Parent | on HN ]
Re:GitHub commit search: “remove password” by remmelt on Wednesday February 15, 2017 @07:00AM (#13651384)
Continuous development, e.g. Jenkins? (Please don’t do this)
[ Parent | on HN ]
Re:GitHub commit search: “remove password” by jayshua on Wednesday February 15, 2017 @08:35AM (#13651850)
Why not?
[ Parent | on HN ]
Re:GitHub commit search: “remove password” by arjie on Wednesday February 15, 2017 @10:00AM (#13652420)
Out of curiosity, why not a deploy user? https://developer.github.com/guides/managing-deploy-keys/
[ Parent | on HN ]
Re:GitHub commit search: “remove password” by TeMPOraL on Wednesday February 15, 2017 @08:55AM (#13651984)
Split it to parts and concatenate it, then?

$key = "BAAD" + "F00D" + "CAFE" + "BABE";

[ Parent | on HN ]
Re:GitHub commit search: “remove password” by Ajedi32 on Wednesday February 15, 2017 @09:09AM (#13652068)
> But i'm more than fine with needing to "obfuscate" an API key or manage secrets correctly
[ Parent | on HN ]
Re:GitHub commit search: “remove password” by Vinnl on Wednesday February 15, 2017 @09:20AM (#13652137)
GitLab has this: https://docs.gitlab.com/ee/push_rules/push_rules.html#preven... (enterprise edition, admittedly)
[ Parent | on HN ]