Tell HN: Github has dozens of public s3 passwords

57 points

16 years ago

I almost pushed my s3 credentials to a public github repo for the third time in one day.

So, I got curious. Are there people out there who forget cover their tracks?

A quick search shows quite a few 'open' buckets out there. What's the best way to warn these folks? What other credentials are lurking out there?

Here's the search: http://github.com/search?langOverride=&language=&q=S3+Base.establish_connection&repo=&start_value=1&type=Code&x=0&y=0

And the first open bucket I found: http://github.com/prakashraman/jammmin/blob/a668672c69fafdb8317fec4fb19b7abb0b318e1a/app/scripts/s3_connect.rb

29 comments