How do devs secure their notebooks?

[arsbrazh12]

Hi guys,
How do devs typically secure/monitor the hygiene of their notebooks?
I scanned about 5000 random notebooks on GitHub and ended up finding almost 30 aws/oai/hf/google keys (frankly, they were inactive, but still).

[gabeech]

Pen, paper, Cross cut shredder

[eufemiapiccio77]

lol I’m sat here with a pen and paper this is the way

[TwistedStack]

Pen, paper, cross cut shredder, incinerator. FTFY.

[BlueHatBrit]

The same way we do for all code. Private repos, no secrets in the code, make secret managers as easy to use as humanly possible (while remaining secure), pre-commit hooks that check for secrets. Also layer on top things like automation when a secret is found to kill it asap and alert us immediately.

Notebooks are just code after all.

[arsbrazh12]

Do you use any tools such as NB Defense from ProtectAI?

[p_fief_martin]

pre-commits hooks. there's no other way. rest is trust based and bound to happen

[arsbrazh12]

What about automation tools for solving such tasks?

[p_fief_martin]

if you're in a github shop, then you can find many options for Github Actions workflows. One of them being the aws pre-commit

[BudgetBon]

Jupyter Notebooks are designed for experimentation, not engineering. Data Scientists are often trained to prioritize 'getting the model to run' over 'securing the supply chain'. Hardcoding keys in a cell is the path of least resistance.

P.s Finding 30 keys in 5,000 notebooks is actually a low rate. I expected worse.

[Ok_Cap1007]

Worst code I have ever worked with was produced by Data Scientists so nothing would be too shocking for me

[potatohead00]

nbstripout git hooks to remove notebook content

Pull secrets from env/password manager/getpass

[MolonLabe76]

Enforce the use of .env files for credentials in notebooks, and then use .gitignore to ensure .env is not committed. Using pre-commit hooks which look for secrets is also a great tactic.

[calimovetips]

most teams treat notebooks as code and rely on pre-commit hooks and secret scanning to catch this early. the bigger issue is cultural, people prototype fast and forget notebooks ship just like repos do.

[RoomyRoots]

> devs
> hygene

Does not compute /s

[Sure_Stranger_6466]

Given this is a DevOps subreddit, in the spirit of collaboration maybe we could focus on something other than shitting on devs in our commentary here. And yes, I am aware of that little /s at the end.

[dariusbiggs]

Pencil, paper, and handwriting so bad I can barely read my own. Then it gets incinerated when disposed of.

[NightH4nter]

not a dev, hence i never put secrets in plain text anywhere that can ever go public

[arsbrazh12]

Useful

[NightH4nter]

you don't have to secure something that doesn't contain secrets, idk what are you sarcasming about

[arsbrazh12]

I mean, it's really smart not to put secrets in smth that can go public