GitMonKey
Security and privacy
secret scanning
SHOW HN2017
70points
45comments
#633of 2,242 in 2017
Top 29%of 2017 by points
How HN took it
RoastedHalf or more of the comments are critical
0 positive, 4 neutral or asking, 0 mixed, 17 critical, out of 21 comments about the project. Thread score -0.67.
Privacy: 0 for, 8 againstIdea: 0 for, 4 againstExecution: 0 for, 3 againstDocs: 0 for, 1 againstPerformance: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Clever name.
From 1 comment
clever name
irfanka on HN
Objections
Requesting read access to all code from an unknown, unverified company is a privacy risk.
From 3 comments
Before I allow this read access to all of my code, what kind of checks should I run through on GitMonKey as an organisation/product? Edit: when I try to go back to the homepage…
kierenj on HNAgreed. Or software you can just run internally. Not a fan of just opening up read access to my code to a new startup.
dberg on HNSounds like a scam to me: - No imprint or any other kind of information who is behind this service on their website - Testimonials which talk about leaked credentials and not…
Dunedan on HN
Treats symptoms; pre-commit hooks and better practices are preferable.
From 3 comments
No, if I want to do my job correctly I'll encourage best practices and address careless deviations. I won't encourage bad behaviour by outsourcing simple workflow tooling to a…
ohyeshedid on HNIt often takes more thought and effort to do things properly. This seems like another service that treats the symptoms of a problem rather than the problem itself. That kind of…
ohyeshedid on HNEasier solution: don't commit private keys. Pro-tip: use `git add -p`
iNeal on HN
Scanner missed keys in earlier commit history.
From 1 comment
One more: I added a repo that I know had some keys in it, and GitMonkey didn't find them. Here's the specifics: I originally made a bunch of commits that included my config.py…
SmellTheGlove on HN
Company identity, privacy policy and testimonials are missing or unclear.
From 3 comments
Sounds like a scam to me: - No imprint or any other kind of information who is behind this service on their website - Testimonials which talk about leaked credentials and not…
Dunedan on HNA little nit-picky, but your "What Our Users Say about Us" section is just people describing their mistakes. It says literally nothing about your platform itself.
adtac on HNBefore I allow this read access to all of my code, what kind of checks should I run through on GitMonKey as an organisation/product? Edit: when I try to go back to the homepage…
kierenj on HN
Requests
Publish a privacy policy and say what happens to source code.
From 2 comments
Sounds like a scam to me: - No imprint or any other kind of information who is behind this service on their website - Testimonials which talk about leaked credentials and not…
Dunedan on HNI would say that if you've forgotten to consider this side of things, it's a big stretch to ask people to trust your app to read all of their source code, which even has the…
kierenj on HN
Scan full commit history, not just branches.
From 1 comment
One more: I added a repo that I know had some keys in it, and GitMonkey didn't find them. Here's the specifics: I originally made a bunch of commits that included my config.py…
SmellTheGlove on HN
Fix broken links and a typo in scan messages.
From 1 comment
Hey shaharsol, this looks great. Double check your strings though :) "Scan 58f90084fa38b600114b33ea succerssfully started." Also the "Profile" and "settings" links don't go…
rorosaurus on HN
Allow login without Google, using GitHub.
From 1 comment
Why does it need to auth using Google? Can it not just use GitHub like the second getting started button suggests?
MightySCollins on HN
Questions
Who is behind the product?
From 2 comments
Before I allow this read access to all of my code, what kind of checks should I run through on GitMonKey as an organisation/product? Edit: when I try to go back to the homepage…
kierenj on HNSounds like a scam to me: - No imprint or any other kind of information who is behind this service on their website - Testimonials which talk about leaked credentials and not…
Dunedan on HN
How can access be revoked?
From 2 comments
Before I allow this read access to all of my code, what kind of checks should I run through on GitMonKey as an organisation/product? Edit: when I try to go back to the homepage…
kierenj on HNYou wouldn't revoke its access on their end, you'd do it on GitHub's end: https://github.com/settings/applications Otherwise, GH would still have the approval on file (there's no…
mynameisvlad on HN
Alternatives named
truffleHog
From 1 comment
How about this one? https://github.com/dxa4481/truffleHog Posted here a few months ago.
sevagh on HN
git-hound
From 1 comment
Also, if you want to have more control over what gets matched (as opposed to only checking entropy): https://github.com/ezekg/git-hound (I'm the author of this one.)
ezekg on HN
pre-commit hooks (detect-private-key)
From 1 comment
http://pre-commit.com/hooks.html calling attention to detect-private-key and detect-aws-credentials (disclaimer-ish: was original contributor on the latter hook but been way…
avh02 on HN
GitHub's built-in token revocation
From 1 comment
Github does this actually but only from github access tokens generated from their API... if you generate an oauth access token and commit it, they will automatically revoke it.
shaharsol on HN