News for hackers. Stuff that matters.

A comment on Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five Years. Parent comment

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by kadoban on Thursday October 13, 2022 @07:30PM (#33197831)
You could set up something like https://github.com/godaddy/tartufo in a pre-commit hook. Not sure if github has a way to hook into the push hooks on server side, they might though.
[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by fiddlerwoaroof on Thursday October 13, 2022 @08:24PM (#33198246)
Yeah, the issue with pre-commit hooks is you have to remember to set them up client-side. I tend to push to GitHub through a gitolite mirror, though, so I could probably put this in the hooks in my gitolite middlebox.
[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by mypalmike on Friday October 14, 2022 @03:31AM (#33200610)
What do you have to set up client side? They can be committed with the project. Or do I misunderstand?
[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by kadoban on Saturday October 15, 2022 @11:47AM (#33215807)
Pre-commit hooks can't be automatically set up on the client side. If they could, this would mean that any repo you clone could run arbitrary code on your machine.

It can be as simple as a script you have to run once, but it can't be automatic. Which also means you can't really trust contributors to do it, even if they're well-meaning some will forget.

[ Parent | on HN ]