One does not commit or compile credentials
Context:
This meme was brought to you by the PyPI Director of Infrastructure who accidentally hardcoded credentials - which could have resulted in compromissing the entire core Python ecosystem.
I also personally ask myself how a PyPI Admin & Director of Infrastructure can miss out on so many basic coding and security relevant aspects:
- Hardcoding credentials and not using dedicated secret files, environment variable or other secret stores
- For any source that you compile you have to assume that - in one way or another - it ends up in the final artifact - Apparently this was not fully understood (“.pyc files containing the compiled bytecode weren’t considered”)
- Not using a isolated build process e.g. a CI with an isolated VM or a container - This will inevitable lead to “works on my machine” scenarios
- Needing the built artifact (containerimage) only locally but pushing it into a publicly available registry
- Using a access token that has full admin permissions for everything, despite only requiring it to bypass rate limits
- Apparently using a single access token for everything
- When you use Git locally and want to push to GitHub you need an access token. The fact that article says “the one and only GitHub access token related to my account” likely indicates that this token was at least also used for this
- One of the takeaways of the article says “set aggressive expiration dates for API tokens” - This won’t help much if you don’t understand how to handle them properly in the first place. An attacker can still use them before they expire or simply extract updated tokens from newer artifacts.
On the other hand what went well:
- When this was reported it was reacted upon within a few minutes
- Some of my above points of criticism now appear to be taken into account (“Takeaways”)
To err is to be human… right?
To be honest, this doesn’t instill me with much confidence, but who am I? If someone looked at my OpSec, probably they’d be horrified.
This will inevitable lead to “works on my machine” scenarios
Isn’t that what Python is all about?
Yes kids, the only stuff in ANY repo (public or otherwise) should be source code.
If it is compiled, built, or otherwise modified by any process outside of you the developer typing in your source code editor, it needs to be excluded/ignored from being committed. No excuses. None. Nope, not even that one.
No. 👏 Excuses. 👏
@carrylex git should be password manager aware and refuse to commit if changes include a password
Well from my personal PoV there are a few problems with that
- You can’t detect all credentials reliably, they could be encoded in base64 for example
- I think it’s kind of okay to commit credentials and configuration used for the local dev environment (and ONLY the local one). E.g. when you require some infrastructure like a database inside a container for your app. Not every dev wants to manually set a few dozen configuration entries when they quickly want to checkout and run the app
You can’t detect all credentials reliably,
Easy. You check in the password file first. Then you can check if the codebase contains any entry on the blacklist.
Wait…
You were so close! The right solution is of course training an AI model that detects credentials and rejects commits that contain them!
I think it’s kind of okay to commit credentials and configuration used for the local dev environment (and ONLY the local one).
No. Never.
E.g. when you require some infrastructure like a database inside a container for your app. Not every dev wants to manually set a few dozen configuration entries when they quickly want to checkout and run the app
In this situation, it would be better to write a simple script that can generate fresh and unique values for the dev.
Laziness is not an excuse.
They do. But, as they say,ake it idiot-proof, and someone will make a better idiot.
If I had a dollar for every API key inside a config.json…
Here’s the thing, config.json should have been on the project’s .gitignore.
Not exactly because of credentials. But, how do you change it to test with different settings?
On the contrary, one can commit or compile credentials quite simply… Maybe Boromir isn’t the right person to ask.
don’t commit credentials; split them up and place each part in a different place in the code and use code comments as a treasure map and make them work for it.
