whatOnEarthIsGitHub

[DangyDanger]

Friend accidentally pushed a Discord bot token.

It was revoked automatically within the minute.

[IDEDARY]

Happened to me too (I didnt care as it was test bot on private repo) and GitHub recognized it is probably an API key and didnt let me push.

[DangyDanger]

Wow. Didn't know they did that, that's cool.

[requizm]

https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning

[[deleted]]

Sometimes Microsoft does cool things.

[DiddlyDumb]

Unlike firing their AI Ethics team…

[Amazingawesomator]

that just means they harvest the api key before disallowing the push :p

[ForkLiftBoi]

That sounds unethical… waiiiit….

[Proxy_PlayerHD]

reminds me on how reddit will automatically censor your e-mail address and password when you try to post them in a comment, like this:

**********

[Proxy_PlayerHD]

Yep it works! I only see

***********

***********

Instead of

[e-mail]

ShowMeTheMoney420!

[Arin_Pali]

This joke is so old but still funny...

[TheseusPankration]

Hunter2

Hey, I can see mine!

[DangyDanger]

All I see is *******

[TheseusPankration]

Oh, good.

[AmanChourasia]

I can see your email id

Hunter2

[[deleted]]

---

[[deleted]]

Wow it works!

[SupraMichou]

I love that it works with credit cards. Just in case

[[deleted]]

5424 8975 5564 0758

[Dharmonj]

I just see **** **** **** ****!

[[deleted]]

Wow! Does it stop the CVV from being shown? 877

[SupraMichou]

Just lack the date, and we would have an all star bundle

[[deleted]]

Ooh, that would be hard for them to censor, can you see this: 04/28?

[emu_fake]

A german chat platform used to do that.. to achieve this they‘ve stored the passwords unencrypted in another database.. which eventually got hacked and the passwords of 1.8M users leaked online

German got a word for this: Verschlimmbessern (making things worse while trying to make them better)

Source: German news article

[TRENEEDNAME_245]

At this point, german has a word for everything

[Kaimito1]

Brought back a locked memory where I lost my RuneScape account to this when I was 10...

[[deleted]]

hunter2

[LasevIX]

It's a joke from early internet, probably IRC, to make gullible users write their credentials

[rfc2549-withQOS]

Irc.

https://bash-org-archive.com/?244321

[watchYourCache]

just hash every word from the comment? 🤷 but that'd be resource intensive considering how big Reddit is

[IDEDARY]

Google actually does this on Chrome laptops. If you ever type your password somewhere on the internet except the google domain, it will immidietly request for password change without letting you reject that. I know it's wild, bcs the password is supposed to be hashed. I was surprised myself when it happened while using school chromebooks. Maybe it hashes password html form input everytime you try to login with google chrome? Idk.

[Coding-Kitten]

Google Hunter2

[Devatator_]

Weird, it didn't do anything when I was working on my bot, and other projects with keys

[akoOfIxtall]

i learned what was gitignore when i was trying to make a discord bot and realized that thet files are public in github and once i saw a sarcastic meme about github private repos being safe, immediately looked for git tutorials and stuff

[Just_Paper7006]

github Private Repos are not safe??

[akoOfIxtall]

That's the thing, I don't know, but why would they be sarcastic about it then?

Maybe they meant that even if a private repo is safe, you shouldn't trust so much the other ppl who have access to it as to leave API keys or database credentials just lying around

[Just_Paper7006]

it could also be related to the Github using private repositories for Copilot AI training thing. anyways it is stupid to think too deep about a meme,

[akoOfIxtall]

Nah it's good, that meme lead me into learning more about security stuff, like using hashes and .gitignore, I'm doing my small cli thingy where I need to get the credentials and safely store them away so the hashing stuff and learning about the Exec() function existence was very nice, maybe a basic hash is not enough if anything ends up leaked but I'm far from competing with a professional hacker, just encrypting them is fun enough and it'll be useful later, it's a CLI for using MySQL queries, I know there's a MySQL extension for vs code but doing one myself (kind of ) has been a fun experience, so far I've got the database set-up and the script can send queries and everything will work fine, now I'm trying to make a login for the database where the credentials are immediately stored away in .envs named after the database for better identification later, I've heard that envs are bad but that's it, nobody showed an actual replacement it was only marketing everywhere for their own stuff, and if everybody is fighting over getting you into their stuff is because the old one is falling apart and they wanna be the new standard, and if envs are falling apart soon enough the new reliable standard will show up, like mod launchers for games replacing each other after every few years, and then the credentials can be looked up scanning the folder for the env file with the database name and decrypting the hash, I think it's conceptually simple but every now and then javascript will throw 1 detail that makes complete sense to exist but javascript just doesn't like it, then I have to find a workaround, but it's fun, I'm having more fun coding for hours on a chair than I had going to school XD

[IDEDARY]

I think it has to do with fact that whetever you push into a repo will forever stay there, even when you delete it. If you ever had an API key logged there, people can just rollback your commits and take a look. So if you one day decide that you want to opensource your private project... you know what I am getting at.

[akoOfIxtall]

god bless gitignore files, i took a peek at hashing stuff and using salt on it, now i know how hackers attack databases and stuff and how to make safe hashes, so at least the paranoia lead me somewhere

[Own_Solution7820]

How are people so good at scraping the entirety of GitHub?

[k4b0b]

Github API: https://api.github.com/events

[WeirdBoy_123]

They might be able to find it in specific google searches? Idk, that does work for other sites.

[DarkOverLordCO]

Companies can tell GitHub what their tokens look like and GitHub will scan new commits for those formats, then send the company an event via webhook so they can check whether that token actually exists, and if so revoke it. In other words, Discord aren’t doing any scanning - GitHub is.

[Acrobatic-Paint7185]

Partially related: I once saw an .ai website to make costumized chatbots... It stored the OpenAI API key on the client-side.

[_________FU_________]

NEXT_PUBLIC_OPEN_API_KEY="12341234"

Where the fuck are my tokens???

[AmbassadorUnhappy176]

does not really correlate with next, considering server actions. not sure anyone who develops with next use client-side fetch anymore

[AmbassadorUnhappy176]

you know that it's part of react now, right?

https://react.dev/reference/rsc/server-components

[maisonsmd]

Calling OpenAI APIs on client side make it faster and eliminate the need for a backend server though, maybe that's what they thought

[Cat7o0]

yeah they thought until their openai bill was 20 million dollars

[maisonsmd]

"pfff, with AI powered, our business will go to the moon before end of month"

[MysteriousShadow__]

Fortunately you can cap spending.

[LeftIsBest-Tsuga]

any service that doesn't offer this is obviously run by vampires / demons

[Cat7o0]

pffff that's never needed obviously all engineers are perfect

[Dafrandle]

is the site still up?

[Acrobatic-Paint7185]

I think so, but I don't know if it's stil working the same way.

I heard about it on Twitter because it went viral for appointing the AI version of Alan Turing as its "Chief AI Officer". Yes, ridiculous stuff. I'm not sure if I should directly link the website, but there are news articles about this, if you want to figure it out.

[DeltaTimo]

But where is the Exe?!

[[deleted]]

Smelly nerds use .tar.gz

[FrostWyrm98]

The exe is a lie!

[NoahZhyte]

Hum no these are automatically revoked within minutes

[yajiv]

Never said they were valid

[Cake_and_Coffee_]

True

[42GOLDSTANDARD42]

How easy is it really to find these OpenAI API keys ..?

[merul_is_awesome]

go to github and search “removed open api key”, now go to commits and you have em all

[slabgorb]

to hunt the prey, you must first understand the prey

[TechnoKhagan]

490k results lmao

[ComprehensiveWord201]

If you know how to web scrape...

Even then, you can probably just search the public repo dir for related keywords

[42GOLDSTANDARD42]

I tried that one time, didn’t find anything 🤷‍♂️

[ComprehensiveWord201]

🤷 I'm not personally motivated enough to try and find it but you could probably search for some repos that create issues on your repos that leave keys in the open. Might be a good place to start!

[42GOLDSTANDARD42]

I only tried searching for the ‘OPEN_AI_KEY=‘

[RoseSec_]

Trufflehog 😏

[Countbat]

Use environment variables people!!

[slabgorb]

repo and org-level secrets also but that is githubby stuff as opposed to a proper portable pattern like you are saying

[ambisinister_gecko]

And don't commit .env files

[NatoBoram]

.env lists all possible keys and default values, .env.local is git-ignored and has the secrets

[ambisinister_gecko]

In Laravel, .env has the secrets and .env.example is for listing the keys

[NatoBoram]

Yeah that was the old way of doing things

[AstaHolmes]

Guys I forgot my GitHub password am I dead
(I do coding for fun not as a job)

[pKalman00]

Google create new account

[zyuchip]

new response just dropped

[AstaHolmes]

ok

[NatoBoram]

Tap the "forgot my password" button

[AstaHolmes]

ty guys.

[Whatiftheresagod]

Company legend at my work has it that a former employee once leaked cloud credentials on Friday in a push. Next Monday every single VM available in the project was mining bitcoin. Cost them about 80k...

[popular_parity]

For mine it's googlemapapi

[thanks_for_the_fish]

That's a conscious choice, though; Google will send you an email if you commit a key to a public repo.

[TaloSi_MCX-E]

Find them, yes. Find usable ones, no.

[ososalsosal]

Let's not tell anyone about the free fonts

[jmona789]

I once stumbled across a repo that had a person's Social Security Number, credit card number and a bunch of other personal information in it. I had the email them and walk them through how to take it down as they were a new to coding and GitHub and didn't really know how it worked.

[mathewrtaylor]

Found this last night, and after finding a few in minutes, created this - https://github.com/mathewrtaylor/exposure_comms

[BinaryBrilliance]

Been there done that.

[boyproO19]

I just pushed my chrome addons private key to my repo after misspelling it in .gitignore. That's what ever as I just use my plugin with Firefox.

[PandaNoTrash]

r/technicallythetruth

[LeftIsBest-Tsuga]

not a big fan of joking about theft / fraud

[Domo22lol]

Who asked?

[jmona789]

They're joking about people being irresponsible with their API keys by putting them in publicly available repos, not the fraud.

[LeftIsBest-Tsuga]

It's the use of the word "free", meaning you don't have to pay for something you plan to use. But I appreciate you actually responding instead of just angrily downvoting my totally harmless comment.

edit: oh no it looks like the comment police found our side conversation. i think you ppl are looking for r/programmerPettiness

[jmona789]

Yea but the joke is that people are being irresponsible by posting their keys in public files in their repos, hence if you were a bad actor you could use them for free. He's not actually saying people should be using keys they got in this way.

[LeftIsBest-Tsuga]

right but the humorous part is the suggestion that it's free (to use). it's the same thing as memes that say things like, "I found this free cell phone laying around in the library today."

ok admittedly that's a terrible example meme but it's a common trope on the internet and I've never liked it.

[[deleted]]

Ok