lumberjack24
Re:Show HN: Forest Admin Cloud
on Wednesday April 26, 2023 @09:32AM (#35713396)
Forest Admin's out-of-the-box admin panel + the convenience of the cloud, this is all developers ever wanted for their internal tools!
Re:Where do stolen bikes go?
on Thursday February 16, 2023 @05:38PM (#34827558)
To Casablanca, Morocco.
Re:The Current Secrets Rotation Process Is Broken
on Friday January 20, 2023 @06:09AM (#34451484)
Hey, maybe try running a GitGuardian [1] scan on all those repositories to look for hardcoded secrets. GitGuardian can also test in some cases if the secrets are valid or not, meaning you have to revoke and rotate them asap. I hope this helps.
[1] https://www.gitguardian.com/monitor-internal-repositories-fo...
Disclaimer: I work for GitGuardian.
Re:Tell HN: Thanks and hats off to all the non software engineers
on Tuesday December 27, 2022 @04:34PM (#34154167)
geez.
Re:Software Dark Matter Is the Enemy of Software Transparency
on Sunday November 13, 2022 @10:44AM (#33584033)
“dark matter” sounds like marketing speak.
Re:Europe now has so much natural gas that prices just dipped below zero
on Thursday October 27, 2022 @05:29PM (#33364304)
well, they haven’t turned my building’s heating on yet.
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five ...
on Friday October 14, 2022 @05:02AM (#33201237)
Here's a checklist [1] (again, from gitguardian) of steps to follow before open-sourcing projects and [2] a guide on how to remediate hardcoded/exposed secrets.
[1] https://blog.gitguardian.com/safely-open-source-software-bes... [2] https://blog.gitguardian.com/leaking-secrets-on-github-what-...
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five ...
on Thursday October 13, 2022 @06:20PM (#33197208)
Great idea, but hard to enforce. Just use a scanning CLI like TruffleHog, Gitleaks, or ggshield from GitGuardian to catch all sorts of hardcoded secrets.
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five ...
on Thursday October 13, 2022 @06:10PM (#33197110)
GitGuardian actually does this, it monitors an extended perimeter of devs and their personal/open-source repos for corporate secrets or keywords – https://www.gitguardian.com/monitor-public-github-for-secret...
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five ...
on Thursday October 13, 2022 @05:34PM (#33196774)
In the meantime, try ggshield cli https://github.com/GitGuardian/ggshield
Re:Toyota Accidently Exposed a Secret Key Publicly on GitHub for Five ...
on Thursday October 13, 2022 @04:49PM (#33196300)
The access model on platforms like GitHub is flawed, a single account can be used for both professional and personal projects/repositories, leading to “fat finger” errors like this one here...
Re:Translating Piracy: On the origin of the Arabic words qurṣān/qarṣanah
on Sunday September 18, 2022 @07:12PM (#32892364)
I can’t help but wonder why qursān ended up being the final form instead of qursāl.
Re:Uber investigating breach of its computer systems
on Friday September 16, 2022 @11:22AM (#32867316)
That hardcoded secret in the powershell script really was the key to the Uber ride-hailing kingdom – https://blog.gitguardian.com/uber-breach-2022.
Re:Ask HN: Anyone working 4 day week here, as an employee?
on Sunday August 21, 2022 @08:35PM (#32545946)
open to referrals?
Re:Show HN: I grew my startup to 100.000 visitors /m with no time for ...
on Monday August 08, 2022 @03:50PM (#32390199)
show me the mrr
Re:Baking bread with the Romans part III – the panis quadratus strikes...
on Sunday July 24, 2022 @06:42PM (#32218521)
Photos don’t load on mobile :/
Re:Comité Liquidant Ou Détournant Les Ordinateurs (C.L.O.D.O.) (1983)
on Saturday July 23, 2022 @01:36PM (#32205559)
These folks must be retired by now and they have lived enough to find out they lost their crusade against computers.
Re:Ask HN: How to get developers and UI designers to work well together
on Tuesday July 19, 2022 @04:33PM (#32157572)
Try https://www.specifyapp.com and thank me later!
Song predicted the rise of smartphones back in 2002
Re:Admit It, Squirrels Are Just Tree Rats
on Tuesday July 12, 2022 @04:52PM (#32075526)
Just like shrimps are sea cockroaches.
Re:In defence of garlic in a jar
on Friday July 01, 2022 @06:42PM (#31953950)
I’m 28 y.o and this is the first time I hear about garlic in a jar. U.S.A never ceases to amaze me.
Re:Mighty: The Browser You Didn’t Know You Needed but Definitely Do
on Monday June 20, 2022 @05:29PM (#31816256)
My brother in Christ, you have an email job and you definitely don't need this browser.
Re:Heroku Security Notification
on Thursday April 21, 2022 @10:00AM (#31109521)
A few days before this attack campaign started, I wrote a guide to help security and engineering teams prioritize and remediate thousands of secrets-in-code incidents.
Hope it can help some of the organizations dealing with this right now!
https://blog.gitguardian.com/a-practical-guide-to-prioritize...
Re:Attack campaign involving stolen OAuth tokens issued to third-party...
on Thursday April 21, 2022 @09:53AM (#31109414)
A few days before this attack campaign started, I wrote a guide to help security and engineering teams prioritize and remediate thousands of secrets-in-code incidents.
Hope it can help some of the organizations dealing with this right now!
https://blog.gitguardian.com/a-practical-guide-to-prioritize...
Re:Surviving the GitHub OAuth hack – remediating thousands of hardcode...
on Thursday April 21, 2022 @09:49AM (#31109365)
The other day I wrote a guide to help security and engineering teams prioritize and remediate thousands of such incidents. Hope it helps!
https://blog.gitguardian.com/a-practical-guide-to-prioritize...
Surviving the GitHub OAuth hack – remediating thousands of hardcoded credentials
While going through other HN threads, I noticed many participants in the discussions recommend that organizations noticing suspicious repo cloning activity start scanning source code for credentials. This is a great advice to limit the damage.But where do you start when you find thousands of secrets exposed?
Re:Ask HN: What is the fastest way to ramp up on DevOps, k8 and GCP?
on Monday November 22, 2021 @06:46AM (#29305358)
If you're looking to add secrets management and scanning to the curriculum, take a look at GitGuardian–https://www.gitguardian.com/monitor-internal-repositories-fo....