TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Finding secrets by decompiling Python bytecode in public repositories

165 pointsby giladalmost 5 years ago

7 comments

scarface74almost 5 years ago
Public Service Announcement.<p>While for the other secrets, I’ve got nothing, there is never a reason to have AWS secret keys in your code or in application specific configuration files.<p>Every AWS SDK will automatically read your keys from your config file in your home directory locally. Just run<p><pre><code> aws configure </code></pre> When you run your code on EC2, Lambda or ECS, the same SDK’s will automatically get the keys associated with the attached role.
评论 #23368836 未加载
maxeonyxalmost 5 years ago
This would be solved if python used an (OS-specific) cache directory for its .pyc files. I have always disliked .pyc files... here&#x27;s a concrete reason!<p>Question: what does python do if it doesn&#x27;t have write permission in the current working directory? Not write the cache?
评论 #23367034 未加载
评论 #23367054 未加载
评论 #23368156 未加载
评论 #23367263 未加载
shockinglytruealmost 5 years ago
Highly recommend &quot;export PYTHONDONTWRITEBYTECODE=1&quot; in your bashrc and just forget about it. Pyc files are still an important optimization on modern machines in some circumstances (especially with huge oft-restarted apps), but the autogeneration behaviour has always been a pain in the ass<p>The bulk of your pycs are generated during package install. What tends to remain in the usual case is a handful of files representing app code or similar.
评论 #23367156 未加载
oefrhaalmost 5 years ago
Just reading the script from TFA, it attempts to find secrets.pyc and decompile it, but doesn&#x27;t even check if secrets.py is also in the repo. A glance at search results (I just used GitHub&#x27;s web interface, didn&#x27;t bother to run the code) tells me when secrets.pyc is committed, secrets.py comes with it at least the vast majority of time.<p>I guess the author did find cases where secrets.pyc is committed but secrets.py is not? It&#x27;s hard to fathom how that could have happened (especially inside &quot;organization&quot; settings). Sounds like the result of absolute rookies in both Python and git following a tutorial with a step &quot;add secrets.py to .gitignore&quot; but unfortunately takes ignoring __pycache__ and ﹡.pyc for granted, which is too much to ask for some people.<p>&gt; it is very easy for an experienced programmer to accidentally commit their secrets<p>No, it doesn&#x27;t take an experienced programmer to put __pycache__ and ﹡.pyc to global ignore, or use a gitignore boilerplate at project creation, or notice random unwanted files during code review.
评论 #23367946 未加载
评论 #23368007 未加载
评论 #23367636 未加载
评论 #23367842 未加载
xvilkaalmost 5 years ago
Radare2 also supports Python bytecode of diffent versions [1].<p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;radareorg&#x2F;radare2&#x2F;tree&#x2F;master&#x2F;libr&#x2F;asm&#x2F;arch&#x2F;pyc" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;radareorg&#x2F;radare2&#x2F;tree&#x2F;master&#x2F;libr&#x2F;asm&#x2F;ar...</a>
neurostimulantalmost 5 years ago
Another possible place to look for secrets is in public docker images. Bots are scanning github repos for secrets all the time, but what about dockerhub (and other docker images repositories)? I accidentally leaved a secret on my public docker image once and that&#x27;s made me quite paranoid about it now.
评论 #23376799 未加载
tucnakalmost 5 years ago
I read &quot;Finding secrets by decompiling Python bytecode in public restrooms&quot; by accident. It never occured to me that anyone would do THAT in there.
评论 #23369513 未加载