Is the joke here that the secrets are still available in git history? Because it's not like recycling a secret after realising it was exposed is a normal thing to do, right?
Though if a secret has ever been uploaded to GitHub, even if you scrubbed it from history within minutes, you should assume it's compromised and generate new credentials.
19 replies
That is an interesting URL
It's a mastodon instance
I’m just impressed with the URL, its very strong
It goes big and hard
( ͡• ͜ʖ ͡•)
There's a prominent tagger around Portland that goes by "girlcock"
Reminds me of that
I was hoping to grab more interesting one, but it seems her profile didn't get updated for quite a while as seen through EC's instance.
https://ec.social-network.europa.eu/@[email protected]
Anyway, yes, the European Commission officially hosts their own Mastodon server.
You also changed the actual values, right?
Right…..??????
commit credentials
change credentials
blank out credentials and recommit
create modsec rule to send anyone who ties to send a request with said key to a honeypot fail2ban jail
???
profit
Never, you have key but now you have to find the lock! It's a treasure hunt!
Your reward? Probably some random cat pictures.
Is the joke here that the secrets are still available in git history? Because it's not like recycling a secret after realising it was exposed is a normal thing to do, right?
Correct
https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History.html
Though if a secret has ever been uploaded to GitHub, even if you scrubbed it from history within minutes, you should assume it's compromised and generate new credentials.
And thats why I like the idea of fossil. Make those mistakes hurt!
I'm glad I learned this lesson in high school & not while working in industry
She's an author.
Also, click her profile, love what she's put in there, like RAADS-R score 🤣
its fine you obvs dont have to rotate your keys because you just git rm'd it.