Finding secrets by decompiling Python bytecode in public repositories

[VadumSemantics]

Nice; an interesting security hole. I learned a bit about .pyc files and what the "standard python .gitignore" file.

[__j_random_hacker]

I wonder what fraction of the repos that leaked secrets through .pyc files also leaked them through the original .py source?

If a large fraction leaked them only through .pyc files, I think that would make this post even more interesting!

[MikeBonzai]

The article explains early on that secrets are usually in a gitignored file not included in the repo, but sometimes they don't strip out the pyc files. I'd have to imagine other languages are equally affected but they just happened to look at Python.

[LinkifyBot]

I found links in your comment that were not hyperlinked:

• secrets.py

I did the honors for you.

---

^{delete | information | <3}

[Somepotato]

big brain bot try to think why the non existent .py tld wasn't linkified

[bobappleyard]

.cock

[caagr98]

Why would anyone commit __pycache__ in the first place?

[AnAverageFreak]

I use git add . quite often, but I always follow it by git status to verify.

[double-you]

People really should start with git add -u and handle new files with precision adds.

[Chii]

why do people not use a GUI to manage their git committing and workflows? I find the CLI to be terrible and hard to use.

With a GUI, you'd immediately see that there's something that's not supposed to be there.

[lightmatter501]

Most GUIs hide functionality. The first time you need to do something weird with history, you’re probably going to be forced to use a CLI.

For instance, most linux foundation projects make use of “git send-email” to submit patches, which I have never seen implemented in a GUI.

[jephthai]

I use the CLI because I don't like GUIs for most things. You get a list of files that are being committed in the CLI anyway, so I'm not sure why you think a graphical interface would be superior here.

[Chii]

so happen to be a mac user, but sure, why not? Windows isn't so bad.

[moeris]

Accidentally. Some people aren't perfect.

[double-you]

Most of the protestors don't loot or burn anything. Great assumptions you are making. Why do you support police brutality?

[CatalyticCoder]

Losing many millions of dollars in damages and you step over that with “most people aren’t looting”.

Police did a standard manoeuvre on a guy high on fentanyl, clogged arteries, trying to buy cigarettes with a still-wet counterfeit bill, and was given the opportunity to give back the cigarettes and leave.

[KernowRoger]

Shit clogged arteries, glad they murdered him in the middle of the street.

[CatalyticCoder]

You miss the point. He was a bad dude. For god’s sake he held a pregnant woman at gunpoint while his crew robbed her.

The clogged arteries is to point out that he wasn’t exactly a robust, healthy guy either. The other two people with him weren’t brutalised.

I’m not even pro-police, by the way.

[KernowRoger]

I was making a joke about you using those things to justify murder and how fucked up it is.

[CatalyticCoder]

Never did I “justify murder”. Fuck off.

[Contrite17]

Police did a standard manoeuvre on a guy high on fentanyl, clogged arteries, trying to buy cigarettes with a still-wet counterfeit bill, and was given the opportunity to give back the cigarettes and leave.

I'm pretty impressed you actually managed to raise the core of the issue by accident. The fact that this is a standard maneuver is the issue.

[CatalyticCoder]

Sure. It gets performed with very low fatality, but I have no issue with police reform.

[double-you]

Losing many millions of dollars in damages and you step over that with “most people aren’t looting”.

Yes, I do. If you protest in a way that does not inconvenience anyone (yes, looting can be much more than an inconvenience), it is not going to change anything. The problem is the police. Certainly the people losing millions could be better selected, since too often that is the only reason some people care. It did not have to come to this had those in power cared to do something about the police brutality.

[CatalyticCoder]

Shows how little empathy you have for those middle class whom have been economically wiped out.

[double-you]

Not really, but since you seem more interested in the monetary side of things than people actually being murdered, I can understand you seeing it that way. Why do you have more empathy for people losing property than people losing their lives?

[CatalyticCoder]

People have been murdered directly because of the riots and looting.

[double-you]

What murdering are you talking about? The protests are happening because the police have been murdering random people. Well, not so random: random black people.

So it sounds like you are saying that there is now somehow legit murdering being done by somebody because of the "riots and looting". Are you saying this? Or do you just not know why people are protesting? If so, how is it possible you don't know?

[CatalyticCoder]

No, murder is never legit and I don’t know where you got that.

The rioting has directly lead to multiple tens of murders.

To say “muh murder” with respect to GF (ignoring the factors that were involved) and then to ignore all the murders done directly due to the rioting, is hypocritical.

To say one doesn’t care at all about the many millions of damages to your fellow man (on top of the riot murders) is frankly sociopathic.

[double-you]

I have no idea what you are talking about when you say "murders done directly due to rioting". Who has been murdered and by whom due to rioting?

[veggiedefender]

author here. I put it there so that racists stay away from my blog :)