Hacker News Reader

This seems a reasonable timeframe to me given the scale of the impact.

Security issues are obviously very important, but equally I would be worried if they started acting impulsively immediately after discovering the issue, because there would not have been time to understand the problem and consider the options. If you jump on a solution without giving it a bit of thought first it's too easy to exacerbate the situation.

View on HN

Its not the time from discovery to rotating the key thats OPs issue. What was the time from key being public until discovery? Thats the issue. And also, while the key was public, did anyone access it?

Agreed. I don't think that was the point the comment I replied to was making though? Maybe I misread it.

Maybe I'm missing something, but since all GitHub events can be watched through the API, I don't think it particularly matters how long it was public. Anecdotal but I once accidentally pushed an AWS key (thankfully heavily locked down and not a root account) for all of 30 seconds and it was compromised anyways.

I agree. Even if its only public for one sec it should be considered compromised. However, everything is a risk management question, so knowing the amount of time it was exposed is helpful for other orgs to determine their response to this incident. Same if there was an accesslog.

Reply on news.ycombinator.com