Hacker News Reader

Comment by bdcravens | Hacker News Reader

There's plenty of situations you don't hear about.

A few years ago I f'ed up and accidentally pushed keys to a public repo, and by the next morning, we racked up $50k in AWS charges from crypto miners. We reached out, they gave us a security checklist that if we followed, they'd take off the charges. We did, and by Monday (my code push was Friday evening) the charges were taken off. No public shaming required.

View on HN

You likely already know that, but to anyone else interested: a good way to prevent these kinds of situations is to run 'nosey parker' on your git repo before pushing it to a remote. It will dig through your code and configs, looking at files and through all the git history, and highlight anything that looks like tokens, passwords, keys, etc. You can set it as a pre-commit hook to block the offending code from even being committed.

https://github.com/praetorian-inc/noseyparker

Github has a similar feature that’s free for public repositories IIRC.

https://github.com/trufflesecurity/trufflehog is a similar tool but checks for far more secrets, so I think it'd be a better choice.

I’m curious what sorts of things were on the checklist. I wonder if it’s something they will share proactively?

It's been a few years, so I'm going off of memory, but it was mostly best practices stuff (enabling Cloudtrail, rotating older keys, etc). Anything to ensure that once the attackers no longer had access, removing/monitoring anything that would have longer term implications.

this makes sense; plug the hole and stop taking on water before you ask for a free cleanup.

Reply on news.ycombinator.com