Meta fined $102M for storing passwords in plain text

Re:Meta fined $102M for storing passwords in plain text by cogman10 on Saturday September 28, 2024 @05:59AM (#41679202)

I gotta level with you, not everyone knows you shouldn't do that.

There's a number of devs that don't think twice about storing sensitive keys in a git repo.

I could 100% see how someone would do this, see log messages with passwords in plain text, and then faff off being the last person to actually look at those logs. "K, this case is done, what's next"

[ Parent | on HN ]

Re:Meta fined $102M for storing passwords in plain text by vidarh on Saturday September 28, 2024 @06:12AM (#41679254)

I worked somewhere not long ago where the "solution" was to run code to scrub repos before building release packages because these packages were in some cases installed in customer networks that drastically increased the chance they might leak. At no point did it seem developers or the devops team realised that the fact they saw the need to do this meant that maybe they should apply the same checks used to scrub in a hook to root them on commit in the first place.

[ Parent | on HN ]