←back to thread

I scanned all of GitHub's "oops commits" for leaked secrets

(trufflesecurity.com)
199 points elza_1111 | 5 comments | 03 Jul 25 06:44 UTC | HN request time: 0.707s | source
Show context
edverma2 ◴[03 Jul 25 07:48 UTC] No.44452644[source]▶
All devs should run open-source trufflehog as a precommit hook for all repositories on their local system. It’s not a foolproof solution, but it’s a small time investment to get set up and gives me reasonable assurance that I will not accidentally commit a secret. I’m unsure why this is not more widely considered standard practice.
replies(2): >>44452810 #>>44452859 #
1. ramon156 ◴[03 Jul 25 08:23 UTC] No.44452859[source]▶
If I'm honest, I don't know how much this happens at work, and even if it does it's not the end of the world. Just scratch the commit from existence.

In my head, the people who accidentally share secrets are also the people who couldn't setup trufflehog with a precommit.

replies(2): >>44452916 #>>44453003 #
2. Arainach ◴[03 Jul 25 08:37 UTC] No.44452916[source]▶
This isn't true in practice. Even among well educated high performing professionals, mistakes happen. Checklists save lives - in medicine, in aircraft maintenance, in all fields.

People who believe they know what they're doing get overconfident, move fast, and make mistakes. Seasoned woodworkers lose fingers. Experienced doctors lose patients to preventable mistakes. Senior developers wipe the prod database or make a commit they shouldn't.

https://hsph.harvard.edu/news/fall08checklist/

>In a study of 100 Michigan hospitals, he found that, 30 percent of the time, surgical teams skipped one of these five essential steps: washing hands; cleaning the site; draping the patient; donning surgical hat, gloves, and gown; and applying a sterile dressing. But after 15 months of using Pronovost’s simple checklist, the hospitals “cut their infection rate from 4 percent of cases to zero, saving 1,500 lives and nearly $200 million,”

replies(2): >>44453182 #>>44453301 #
3. oreilles ◴[03 Jul 25 08:51 UTC] No.44453003[source]▶
> Just scratch the commit from existence.

Unfortunately, that is impossible: https://trufflesecurity.com/blog/anyone-can-access-deleted-a...

4. IshKebab ◴[03 Jul 25 09:22 UTC] No.44453182[source]▶
It's crazy how many people don't know this, despite it being fairly obvious.

I guess it's hubris. I don't make stupid mistakes. You see it a lot in discussions around Rust.

5. xlii ◴[03 Jul 25 09:39 UTC] No.44453301[source]▶
Aye.

I made shameful mistake of submitting private key (development one so harmless) only because it wasn’t gitignored and prehook script crashed without deleting it). More of a political/audit problem than a real one.

I guess I’m old enough to remember Murphy Laws and the one saying "safety system upon failure will bring protected system down first".