• Web3 developer Brian Guan lost $40,000 after accidentally posting his wallet’s secret keys publicly on GitHub, with the funds being drained in just two minutes.
  • The crypto community’s reactions were mixed, with some offering support and others mocking Guan’s previous comments about developers using AI tools like ChatGPT for coding.
  • This incident highlights ongoing debates about security practices and the role of AI in software development within the crypto community.
371 points

The developer said he forgot that his secret keys were in the repository.

If you have your secret keys in your repository you’ve already fucked up, long before you accidentally make that repository public.

permalink
report
reply
92 points

One of the first things you should do in a repo is add a .gitignore file and make sure there are rules to ignore things like *secret* or *private* etc. Also, I pretty much never use git add . because I don’t like the laziness of it and EVERY TIME one of my coworkers checked in secrets they were using that command.

permalink
report
parent
reply
55 points

Even though that’s a good extra precaution, per person config data, such as keys, should be stored outside of the repo, eg. in the parent directory or better in the users home dir. There is zero reason to have it in the repo. Even if you use a VM/containers, you can add the config in an extra mount/share.

permalink
report
parent
reply
6 points

What’s the general consensus on storing encrypted data in the repo with the keys outside? I see people recommend that but I’m too paranoid and my secrets are very small in size so it hasn’t been necessary.

permalink
report
parent
reply
15 points

I basically always do a git add -p

Very useful command and it works with other git commands as well.

Everytime a colleague asks me for help with git that’s the one rule I suggest them to use.

permalink
report
parent
reply
4 points

What does that do?

permalink
report
parent
reply
6 points

Better yet you can configure gitignore globally for git. I do this mostly to avoid polluting repo ignore files with my editor specific junk but *.key and similar can help prevent accidents.

https://git-scm.com/docs/gitignore

permalink
report
parent
reply
4 points

For personal projects that’s definitely a good idea. For team projects I like to keep that stuff in the project still so the “experience” of working in the project is mostly consistent.

permalink
report
parent
reply
2 points

Better yet you can configure gitignore globally for git.

I think you really need the project specific gitignore as well, to make sure any other contributor that joins by default has the same protections in place.

permalink
report
parent
reply
5 points

I never understood why everyone uses it as a ignore list. In my own and work repositories I always exclude everything by default and re-add stuff explicitly. I have had enough random crap checked in in the past by coworkers. Granted, the whole source folder is fully included but that has never been a problem.

permalink
report
parent
reply
1 point

git add -u is pretty nice, it only adds modified files.

I usually do git add -p which is interactive (helps avoid committing debugging prints and whatnot), but the other is nice for bigger refactors.

permalink
report
parent
reply
44 points

I use this as a pre-commit hook https://github.com/americanexpress/earlybird

permalink
report
parent
reply
26 points

And that’s why you always leave a note recheck your .gitignore file before committing

permalink
report
parent
reply
7 points

Does Microsoft’s GitHub offer any pre-receive hook configuration to reject commits pushed that contain private keys? Surely that would be a better feature to opt all users into rather than Windows Copilot.

permalink
report
parent
reply
4 points
*

They notify but iirc only if you push a commit to a public repo. The dev in the article pushed it to a private repo, then later made the repo public.

permalink
report
parent
reply
2 points

they notify but that’s all

permalink
report
parent
reply
1 point

They have something called advanced security that can scan for things like secrets. It works on PRs though, so not very helpful if you have a public repo.

permalink
report
parent
reply
4 points
Deleted by creator
permalink
report
parent
reply
3 points

I can’t understand how people use git from the command line without a proper visual tool such as Sublime Merge

permalink
report
parent
reply
1 point

You can also do git diff --cached to see all changes you added to the index.

permalink
report
parent
reply
7 points

Ehhh. I mean, I have local repositories that contain things that I wouldn’t want to share with the world. Using git to manage files isn’t equivalent to wanting to publish publicly on github.

I could imagine ways that private information could leak. Like, okay, say you have some local project, and you’re committing notes in a text file to the project. It’s local, so you don’t need to sanitize it, can put any related information into the notes. Or maybe you have a utility script that does some multi-machine build, has credentials embedded in it. But then over time, you clean the thing up for release and forget that the material is in the git history, and ten years later, do an open-source release or something.

I do kind of think that there’s an argument that someone should make a “lint”-type script to automatically run on GitHub pushes to try and sanity-check and maybe warn about someone pushing out material that maybe they don’t want to be pushing to the world. It’ll never be a 100% solution, but it could maybe catch some portion of leakage.

permalink
report
parent
reply
16 points

Users often don’t take care to separate private and public environments. They just dump all their stuff into one and expect their brain to make the correct decision all the time.

Put your private data into a private space. Never put private data into a mixed use space or a public space.

e.g. Don’t use your personal email at work. Don’t use your personal phone for business. Don’t put your passwords or crypto keys in the same github or gitlab account or even instance and don’t reuse passwords and keys, etc.

permalink
report
parent
reply
2 points
*

Put your private data into a private space. Never put private data into a mixed use space or a public space.

Sure, but nothing I said conflicts with that.

I’m talking about a situation where someone has a private repository, and then one day down the line decide that they want to transition it to a public repository.

You’re not creating the repository with the intention that it is public, nor intending to mix information that should be public and private together.

permalink
report
parent
reply
14 points

Having plain text secrets, or having secrets at all in a repository is always a bad practice. Even if it’s a super-duper private/local/no one will ever see this repo.

permalink
report
parent
reply
3 points

That’s exactly what pre-commit.com project is doing

permalink
report
parent
reply
124 points

I have no sympathy for him, if he is a crypto developer he knows how important those private keys are. And he also knows people scrape public areas all the time looking for keys just like that. The whole point of crypto is to be immutable, so that money is simply lost to him now.

He seems to know how much of a dumb mistake that was, although his description of himself was a bit more colorful.

permalink
report
reply
12 points

You’re not wrong about how important those keys are and how he definitely should have known better. But I at least have a little sympathy for the guy. Everyone makes mistakes from time to time, even with important stuff. Hopefully they are lucky enough not to lose 40k on one but unfortunately he wasn’t. Whether he should have known better or not, that just plain sucks.

permalink
report
parent
reply
11 points

The whole point of crypto is to be immutable, so that money is simply lost to him now.

IIRC there are several cases where some group of people lost big enough coins and force most of the miners to fork to get their money back. Not bitcoin though.

permalink
report
parent
reply
21 points
*

If that doesn’t make everyone lose 100% trust in coins that do that, I don’t know what will.

permalink
report
parent
reply
2 points
1 point

That’s insane that this really happened.

permalink
report
parent
reply
111 points

I can’t believe someone would be so stupid and careless as to develop Web3 software.

permalink
report
reply
10 points

Did we not learn our lessons from Web 2.0?

permalink
report
parent
reply
6 points

Got me good

permalink
report
parent
reply
1 point
Deleted by creator
permalink
report
parent
reply
86 points

They made 2 errors.

  1. Use crypto

  2. Storing the key anywhere close to the repo.

permalink
report
reply
14 points
  1. Letting AI code for you
permalink
report
parent
reply
0 points

You need an escape backslash character (\) before the #3 so it doesn’t show as a #1.

permalink
report
parent
reply
1 point
*

Works fine for me, lemmy.today on desktop browser.

Sucks that your medium for viewing is wrong, maybe you should go complain about the wrongness to the people who maintain it?

permalink
report
parent
reply
82 points

It must be automated for it to happen in 2 minutes. Which implies these kind of things happen often enough for someone to write a script for it.

permalink
report
reply
92 points
*

Yes, it absolutely is automated.

There are bots running constantly looking for things that match patterns for exploitable credentials in public commits.

AWS credentials

SSH keys

Crypto wallets

Bank card info

If you push secrets to a public github repo, they will be exploited almost immediately.

permalink
report
parent
reply
9 points

The scanning part is definitely automated by many different actors (for the gains or the “lulz”), but being this fast, also automated key usage (account draining) must have been implemented which is a bit more impressive…

permalink
report
parent
reply
3 points

Not really. All of the underlying mechanics of crypto are so simple that they can be very easily interacted with by bots. Bots make up the vast majority of all crypto trades; mostly wash trading, but also front-running attacks, scams or outright thefts like this one. There are so many exploitable flaws in crypto that every bug is basically a self-executing bug bounty.

permalink
report
parent
reply
59 points
*

If it was a script I wrote, it would have successfully stolen the $40k, but also stolen my own money and deposit both sets of money into a second intended victims account because I forgot to clear a variable before the main loop runs again.

permalink
report
parent
reply
15 points

You always mess up some mundane detail!

permalink
report
parent
reply
4 points

It would have deposited the funds in an account “foobar123” and been lost forever

permalink
report
parent
reply
1 point
*

Might have happened in this case too, you never know.

permalink
report
parent
reply
20 points

Oh yes absolutely, there are bots constantly crawling any open source code. A friend of mine accidentally leaked their discord API key, nuked a whole server within minutes.

permalink
report
parent
reply
8 points

There must be bots trolling GitHub for API keys, crypto secret keys, and other such valuable data

permalink
report
parent
reply

Technology

!technology@lemmy.world

Create post

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


Community stats

  • 17K

    Monthly active users

  • 12K

    Posts

  • 543K

    Comments