This meme was brought to you by the PyPI Director of Infrastructure who accidentally hardcoded credentials - which could have resulted in compromissing the entire core Python ecosystem.

you are viewing a single comment's thread
view the rest of the comments

[–] PlexSheep@infosec.pub 9 points 4 months ago (2 children)

This sounds like a really useful solution, how do you implement something like this? Especially with linter integration

[–] dan@upvote.au 7 points 4 months ago* (last edited 4 months ago)

I'm not sure, sorry. The source control team at work set it up a long time ago. I don't know how it works - I'm just a user of it.

The linter probably just runs git diff | grep @nocommit or similar.

[–] zqwzzle@lemmy.ca 4 points 4 months ago (1 children)

Depending on which stack you’re using, you could use https://danger.systems to automatically fail PRs.

[–] PlexSheep@infosec.pub 4 points 4 months ago (1 children)

PRs? Isn't the point of @nocommit that something does not get committed, and therefore no credentials are stored in the git repository? Even if the PR does not get merged, the file is still stored as a hit object and can be restored.

[–] zqwzzle@lemmy.ca 2 points 4 months ago

I read the lint part and my brain forgot about everything else. You could stick the danger call in a pre commit hook though.