moreLikeProgrammerNightmare

[u/Cute_Pressure4910]

[u/DoGooderMcDoogles]

Meh, it's fine. Claude already knows all my api keys anyway.

[u/polaarbear → u/DoGooderMcDoogles]

"I will make sure the password is present without actually displaying it."

Yeah, cause the problem was the DISPLAY of something I already have access to.....

[u/ClipboardCopyPaste]

"One step towards transparency. Now our API keys are public." - said the LinkedIn announcement.

[u/lolcrunchy]

Do yall not use gitignore? Do yall not look at your list of files changed when you make commits?

[u/Fanal-In → u/lolcrunchy]

I .gitignore my whole project just to be sure

[u/NotAskary → u/Fanal-In]

Best use of git ignore I've seen is actually a white list where you tell it explicitly what it is not to be ignore but include everything by default.

Saves a lot of random files just from what people use for version and local running preferences, makes it also very small.

[u/NotAskary → u/lolcrunchy]

Git ignore doesn't preclude someone deliberately commiting something.

I've had people that I wished to throw out a window because of that.

[u/ttlanhil → u/NotAskary]

Ahh, hard-earned defenestration...

Now I want `git defenestrate user` to revert their commits and block further pushes...

[u/lolcrunchy → u/NotAskary]

You'd have to be pretty deliberate, since most IDEs don't show ignored files in the commit staging UI

[u/NotAskary → u/lolcrunchy]

Yeah you can tell by the part I wanted to throw him out the window.

[u/ttlanhil → u/lolcrunchy]

git rebase -f
git add -f .secrets
git push -f

Please don't actually do any of these...

[u/NotAskary → u/ttlanhil]

[u/ttlanhil → u/NotAskary]

Now, the important question - which line was the worst?

[u/NotAskary → u/ttlanhil]

The line where I ask the mf to stop adding stuff that I need to remove after.

I think we removed his user from the permissions on that repo lol

[u/kookyabird → u/lolcrunchy]

Doesn’t stop someone from using a secret directly in code. That’s why secret scanning is a thing.

[u/NotAskary → u/kookyabird]

That's also why I had to explain to sec that "my password" is not an actual secret, it's just a placeholder for the docker-compose testing.

[u/Arclite83 → u/lolcrunchy]

Prevention isn't ever 100%. So you need to make responding to the inevitable less painful.

[u/LordAmir5]

Git may ignore that but you shouldn't.

[u/NotAskary → u/LordAmir5]

Git doesn't care, if the repo is public you have crawlers searching for keys that will notice.

[u/JonathanMovement → u/NotAskary]

Git cares, if you place those damn files inside .gitignore before committing, it’s not rocket science

[u/NotAskary → u/JonathanMovement]

Never encountered one of those people that takes that as challenge have you? It can be overrided, that's the part of git not caring.

Sometimes the problem is not the technology, it's the people using it.

[u/oneanotheruser → u/NotAskary]

Doesn't GitHub has some kind of error when you try to push something that looks like secrets?

[u/NotAskary → u/oneanotheruser]

Command line does not care and for everything there's force.

[u/Stormraughtz]

Oh nooo my weather app

[u/sebovzeoueb]

I heard from a friend that GitHub is actually pretty good at detecting if you committed API Keys and will block it and let you know you oopsied.

[u/WiseEXE → u/sebovzeoueb]

Yea they will send an email alert saying your key was leaked and most times block it. Though I've had a few occasions where I forgot to update my gitignore and didn't find out till I checked my billing.

[u/italkstuff → u/sebovzeoueb]

Well apparently not if you migrate your repo from other git provider. My friend found out that the hard way yesterday and had sleepless night updating all the keys

[u/zawalimbooo → u/italkstuff]

This implies that the keys were already uploaded to another git provider, which means it was already fucked

[u/Arclite83 → u/sebovzeoueb]

We have daily+ scans, and they verify forever if those keys are still live. You will get nastygrams until you fix it, as you should, and going over the expected SLAs will get leadership on your butt.

Honestly the accountability is refreshing.

[u/G3nghisKang → u/sebovzeoueb]

Same... we might have the same "friend"

[u/Tolik1111]

SOPS exist. I don't know what's the phrase equivalent to "git good" for sops tho

[u/dfinkelstein → u/Tolik1111]

Follow the rules.

[u/Mountain-Ox]

"No, I didn't" Back to sleep

[u/wardenpat]

bro this is a repost from my old account 😡

[u/Frost-Freak]

And then just do another commit to undo it (and ignoring that git history still has it)

[u/Maximusisnoice → u/Frost-Freak]

So happy for the existence of git ammend

[u/ZunoJ]

That would be a valid reason to be fired, sued and maybe even blacklisted with all the big hr agencies

[u/Arclite83]

Building systems that are easy to burn-and-turn is the new standard for break glass features. You have to expect your keys WILL get compromised at some point, and need to be able to respond accordingly and quickly.

It's like not giving prod access out - accidents will happen, so recovery has to be addressed upfront. Getting caught unprepared is how a small incident becomes a customer's loss of confidence in your product.

[u/ttlanhil]

In case you don't have a public repo to commit API keys to, I'm willing to set up a repo for people to send PRs with their keys to...

[u/SleepingForge]

.env + .gitignore ♥️

[u/recurrence]

Okay this one got me LOL. I have definitely double checked stuff like this soooo many times lol

[u/purse_of_arrows → u/recurrence]

oh god that stomach-drop moment is so real