News for hackers. Stuff that matters.

A comment on Nissan code leaked after bitbucket repo set-up with defaults admin/admin. Parent comment

Re:Nissan code leaked after bitbucket repo set-up with defau... by bob1029 on Thursday January 07, 2021 @11:00AM (#25672491)
Look at some practical implementations. E.g. Jenkins CI. When you first install it (the latest versions), it does not use default admin/admin credentials. What it does is produce a random password string that you have to go find on disk to perform the initial setup. At no point could someone without direct access to the machine get in before you are able to lock the door.
[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by isbvhodnvemrwvn on Thursday January 07, 2021 @11:17AM (#25672815)
While this practice is OK, I am not sure if Jenkins with its billions of trivial vulnerabilities in every other plugin is a poster child for security.

https://www.jenkins.io/security/advisories/

[ Parent | on HN ]
Re:Nissan code leaked after bitbucket repo set-up with defau... by JosephRedfern on Thursday January 07, 2021 @11:38AM (#25673219)
Which is totally irrelevant in the context of this discussion (which is on default passwords).
[ Parent | on HN ]