• Web3 developer Brian Guan lost $40,000 after accidentally posting his wallet’s secret keys publicly on GitHub, with the funds being drained in just two minutes.
  • The crypto community’s reactions were mixed, with some offering support and others mocking Guan’s previous comments about developers using AI tools like ChatGPT for coding.
  • This incident highlights ongoing debates about security practices and the role of AI in software development within the crypto community.
    • bamboo@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 年前

      Does Microsoft’s GitHub offer any pre-receive hook configuration to reject commits pushed that contain private keys? Surely that would be a better feature to opt all users into rather than Windows Copilot.

      • redcalcium@lemmy.institute
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        1 年前

        They notify but iirc only if you push a commit to a public repo. The dev in the article pushed it to a private repo, then later made the repo public.

        • PumaStoleMyBluff@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 年前

          The docs say they can reject if you enable push protection, which is also available for private repos, just as a paid feature. It’s free for public, but still needs to be enabled.

      • chilicheeselies@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 年前

        They have something called advanced security that can scan for things like secrets. It works on PRs though, so not very helpful if you have a public repo.

      • Scrollone@feddit.it
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 年前

        I can’t understand how people use git from the command line without a proper visual tool such as Sublime Merge

        • chilicheeselies@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 年前

          Visual tooks are great, but they all have their own idea of how to manage files commits etc. Understand the cmd line and then you will understand your gui tools. I use a little of both, depending on the task

    • Faresh@lemmy.ml
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 年前

      You can also do git diff --cached to see all changes you added to the index.