When a bad day gets worse – getting hacked twice in one day

Re:When a bad day gets worse – getting hacked twice in one day by moot on Tuesday May 06, 2014 @01:17PM (#7705792)

Good point -- frankly I'd suggest doing both (clean repo and revoke/replace the secrets). The developer in question simply overlooked the issue, and since we were busy spinning down the company, nobody else caught it.

[ Parent | on HN ]

Re:When a bad day gets worse – getting hacked twice in one day by stouset on Tuesday May 06, 2014 @07:59PM (#7707895)

Also, just swear of ever committing secrets to a repo to begin with. It's a bad idea, period.

[ Parent | on HN ]

Re:When a bad day gets worse – getting hacked twice in one day by StavrosK on Wednesday May 07, 2014 @08:41AM (#7709785)

There are many times when that isn't doable. Fortunately, you can swear off ever committing plaintext secrets to a repo. I use git-crypt:

https://github.com/AGWA/git-crypt

[ Parent | on HN ]