News for hackers. Stuff that matters.

A comment on GitLeaks – Search engine for exposed secrets on GitHub.

Re:GitLeaks – Search engine for exposed secrets on GitHub by nitza on Friday February 17, 2017 @06:57AM (#13667602)
Why not use your knowledge of these exposed secrets for good? You know which repo they're coming from, it'd be super simple to let the owner know rather than potentially costing them time and money.

It also seems as though the only use of this site is to capitalise on other people's mistakes? It looks like you're just handing over leaked data to people who will definitely abuse it, which seems to go against your core business of preventing data leaks?

[ Parent | on HN ]
Re:GitLeaks – Search engine for exposed secrets on GitHub by koolba on Friday February 17, 2017 @07:11AM (#13667679)
Would it be considered spamming to pull the email address of the commits and send them an automated email?
[ Parent | on HN ]
Re:GitLeaks – Search engine for exposed secrets on GitHub by nitza on Friday February 17, 2017 @07:16AM (#13667703)
Well, you don't need to send an email necessarily, a GitHub issue with a guide on how to include sensitive data in a public repo would probably suffice.
[ Parent | on HN ]
Re:GitLeaks – Search engine for exposed secrets on GitHub by johncolanduoni on Friday February 17, 2017 @08:26AM (#13668105)
I suspect it would be easy to secure GitHub's cooperation in this, but almost certainly not for money or via a black box.
[ Parent | on HN ]
Re:GitLeaks – Search engine for exposed secrets on GitHub by rmc on Friday February 17, 2017 @08:35AM (#13668141)
Would it be against the GitHub terms of service to do such an email?
[ Parent | on HN ]
Re:GitLeaks – Search engine for exposed secrets on GitHub by lrusnac on Friday February 17, 2017 @07:04AM (#13667635)
I agree with what you wrote. My two cents are: seems that getting attention goes against being nice to others, such a shame living in such a society.
[ Parent | on HN ]
Re:GitLeaks – Search engine for exposed secrets on GitHub by tokenizerrr on Friday February 17, 2017 @07:17AM (#13667711)
Yet if people don't know the risk exists, they'll continue being ignorant and fucking up. Awareness is a good thing.
[ Parent | on HN ]
Re:GitLeaks – Search engine for exposed secrets on GitHub by nitza on Friday February 17, 2017 @07:25AM (#13667743)
This isn't awareness though. This is like telling a specific set of people about all the houses near by that have their front door key under the mat. You only become aware of the issue when it is too late.
[ Parent | on HN ]