Hacker News Reader

Comment by JosephRedfern | Hacker News Reader

Looks good. Hopefully someone will write something to automagically search for unintentionally exposed sensitive files and notify the repo owner - when the "human" version of Code Search came out, a lot of private keys and other such things were discovered.

View on HN

The other possibility is that someone creates a malicious service that harvests and tries connecting using those keys. Scary indeed.

People leave private keys in repos all the time. I'm pretty sure this talk goes over it pretty well. https://www.youtube.com/watch?v=AwUJ9vpR7Vg

I'm not sure I want automated bots contacting me through github.

Why not? Serious question.

When I searched Github it seemed like most of the supposedly leaked passwords were actually examples or placeholders and not a problem.

It would be one thing if Github ran (or at least sanctioned) a feature that warned you of possible security problems, but I don't think I'd like potentially multiple, poorly-coded bots going around messaging repo owners.

Even if it's letting you know your id_rsa file and ~/.ssh/config is exposed? I know I'd want to know...

Malicious bots don't care if there is an API. They can screen scrape easily.

I'm sure malicious bots do try to mass message repository owners through Github. It's called spam and every platform over a certain size experiences it. I expect Github already has measures in place to block it.

Please someone code it.

Reply on news.ycombinator.com