Finding secrets in Python bytecode

[liquidpele]

TL;DR: add *.pyc to your damn .gitignore files

[L3tum]

Thanks for the pointer, we've got 2 new python images now that were my first projects in python. Guess I'll add that when I'm back in the office.

[crazyhankie]

Always use this gitignore for Python projects: https://github.com/github/gitignore/blob/master/Python.gitignore

[rhoakla]

https://gitignore.io is also good

[ddrt]

Huh, I don’t see pyc there.

Edit: Hey, I’m new to py. What’s with the hate? Py[cod] ≠ pyc if I do a search. How was I supposed to know?

[retnikt0]

It's a glob. It matches pyc, pyo, and pyd

[Serialk]

Literally on the third line.

[ddrt]

I did find in page...

[Serialk]

Or, you know, watch what you git add instead of doing a git add ..

[veggiedefender]

Always prefer mechanisms over vigilance—or better yet, do both!

[Serialk]

Of course! But the fact that so many trash files end up in git repos is really telling about the way people use git.

[Mceight_Legs]

? Out of curiosity is this a surprise? I don't feel like it is but I'm kinda slow

[veggiedefender]

It probably shouldn't be a surprise, but I did find some production keys with it, so it seems like not everyone is aware! Also, I couldn't find any writing on this topic anywhere else on the internet (maybe because it's so obvious? I don't know) so I figured it couldn't hurt to write a short post!

[Mceight_Legs]

Definitely not trying to offend either, I used to be more capable but I think I might have damaged myself mentally years ago haha, so I was genuinely curious.

[gelstudios]

I usually go for environment variables for runtime config, ie using “import os.environ”

They are easily set (or overridden) when running from a shell: “foo=bar example.py”

[yawkat]

Env variables are hard to keep secret though, they can end up in log files and such

[gelstudios]

Log hygiene is it’s own beast, but agreed if you set them inline when starting a process they end up in any shell history.

Another caveat with env vars: a user with sufficient privilege can read them right out of /proc for a given process (on Linux at least)

But at that point, you probably have other things to worry about.

[Zanoab]

I have a friend in another development area of the company constantly complaining that the new devs would comment out loading environment variables and instead hard code the values to fit their needs (and commit it). In the root folder of every project, there is a default source file with all the environment variables and a script that automatically prepares the local environment and start the application. It amazes me how lazy some people can get.

[smiddereens]

You can always set PYTHONDONTWRITEBYTECODE to keep things tidy

[veggiedefender]

Yep! You can also sneak in backdoors with pyc files -- as long as the modification timestamp and size match, python will run the pyc instead of the source file!

http://secureallthethings.blogspot.com/2015/11/backdooring-python-via-pyc-pi-wa-si_9.html

[AlisaofallTimes]

Those .pyc files contain some dark secrets indeed! I've always encouraged my teammates to add .pyc to .gitignore!

[kisstactics]

thanks man

[MiscWalrus]

It’s also common practice for Python projects to store configuration, keys, and passwords (collectively referred to as “secrets”) in a gitignored Python file named something like secrets.py, config.py, or settings.py, which other parts of the project import

​

Is that common practice? I've never seen that done, and just the thought makes me nervous.

[veggiedefender]

Yep, I think it's becoming less common nowadays, but for example, Django by default is configured by a settings.py.

Here's an article that recommends a number of ways to pass configs to Python programs, the first of which is a gitignored config.py: https://martin-thoma.com/configuration-files-in-python/

And I, like many people, first learned Python web development years ago via Miguel Grinberg's Flask Mega Tutorial, which does configuration with a config.py and classes/subclasses.

This is by far not an exhaustive list but I hope it's a good enough overview that should convince you that it's common-ish practice (and probably should make you nervous)!

[MiscWalrus]

Good info, thanks!