News for hackers. Stuff that matters.

A comment on Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five Years. Parent comment

Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by ChrisMarshallNY on Friday October 14, 2022 @05:46AM (#33201467)
I deal with this by having a directory in my development tree, named ”doNotCheckThisIntoSourceControl”, and I add a wildcard of it to my global .gitignore.

I’ll put things like server secrets and whatnot, there.

Of course, I need to make sure the local directory is backed up, on this end, since it is not stored in git.

Works a treat.

[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by scarface74 on Friday October 14, 2022 @08:27AM (#33202590)
That’s really not a great idea…
[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by ChrisMarshallNY on Friday October 14, 2022 @09:01AM (#33202959)
...and why?

I am serious. If there is a better way, I'd use it.

Remember that I don't do online/server-based stuff. Most of my projects are for full compilation/linking, and rendering into host-executable, binary apps. There's a bunch of stuff in my development process that never needs to see a server.

[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by scarface74 on Friday October 14, 2022 @09:20AM (#33203154)
A super simple way is to have a script in your home directory - far away from your repos - that set environment variables that you read in your configuration.
[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by ChrisMarshallNY on Friday October 14, 2022 @09:23AM (#33203189)
That makes sense. I could do something like that.
[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by scarface74 on Friday October 14, 2022 @10:45AM (#33204223)
That’s basically the idea - get your credentials out of your dev tree. I’m not dogmatic about how it’s done.
[ Parent | on HN ]
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub... by insane_dreamer on Friday October 14, 2022 @01:13PM (#33206274)
Try AWS Secrets
[ Parent | on HN ]