If anything, I'd love to see somebody do a blog post instead about how they started scraping these results and/or the commit data firehose and messaging users who posted credentials
What is the best way to share things like API keys among a team of developers, anyway? I'm surprised this hasn't been solved already (perhaps it has and I just don't know about it). I know you can share passwords with tools like LastPass and 1Password, and I suppose you could use those for API keys as well?
It'd be nice if you could, e.g., include a gem in a Rails project, get a single key/password/token from one of the team members on that project, and use that w/ a third party API to set all the requisite API keys for all the third party services used on a project. You could also rotate the master password when team members leave the group.
They're also pretty good about forgiving the charges for the fraudulent use.
> What is the best way to share things like API keys among a team of developers, anyway? I'm surprised this hasn't been solved already (perhaps it has and I just don't know about it). I know you can share passwords with tools like LastPass and 1Password, and I suppose you could use those for API keys as well?
Here, we have an IAM account for each dev. Permissions are basically read anything except a few sensitive things (billing, IAM), plus the write permissions we need as operators. We each have our own console login password, and keep our own access keys locally. It's pretty easy to add/remove accounts for new/departing devs, and the potential to individualize permissions is there.
And it might be possible to achieve some success with git filters[2], at least to avoid pushing secrets into the repository.
Still... just my two cents, I'm not exactly a pro-user of those two features
[1](https://github.com/StackExchange/blackbox)
[2](https://stackoverflow.com/questions/6557467/can-git-ignore-a...)
Just my $0.02.
A better question would be: Could Github be successfully found liable for other users leaving their own keys in a public repository?
-y This option will read a private OpenSSH format file and print an OpenSSH public key to stdout.
For example:
ssh-keygen -y -f id_rsa > id_rsa.pub
However, The majority of the keys I'm seeing are either encrypted, test fixtures, or otherwise. There are many unencrypted keys available, though!
It's still surprising that people continue to check in private keys. No one learns.
Example: https://github.com/search?utf8=%E2%9C%93&q=filename%3Aid_rsa...
filename:id_ed25519 filename:id_rsa filename:id_dsa filename:id_ecdsa
