TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Sourcegraph: Incident involving unauthorized admin access

81 pointsby 0xedbover 1 year ago

6 comments

yorickover 1 year ago
Sourcegraph seems to have collected a bunch of these (now leaked) email addresses from signups on self-hosted instances.<p>I remember being very surprised when I was signed up to their mailing list after I made an account on my self-hosted instance, and I&#x27;m not sure about the ethics (and legality) of collecting these in the first place.
评论 #37357933 未加载
mirekrusinover 1 year ago
Overall very well handled and communicated. To get 11 points out of 10 remove adjectives from communication. When people read “quickly” they don’t think “oh great they were quick, I’m going to trust them more now”, they think “communication is biased”. Just write facts (ie time stamps or if you don’t have them use “hours” or “same day”).
评论 #37421189 未加载
dspillettover 1 year ago
<i>&gt; accidentally committed a code change that contained an active site-admin access token</i><p>Our regular reminder to try keep credentials and other security tokens well away from any source code where-ever possible, even if that might mean making things a touch less convenient.<p>I&#x27;d guess that most of us have checked in or otherwise posted a credential at some point in our careers. I&#x27;ve certainly done it in the past with an application DB connection string and had to do the quick reconfigure to revoke that access¹ – in that instance resolution was quick &amp; easy but for other environments it might be a lot more admin.<p>Being careful isn&#x27;t the solution because mistakes will always happen, making it damn near impossible to accidentally post credentials is the way to go.<p>--<p>[1] even though the repo checked into could only be accessed from within the company, and the DB instance in question was locked down so only the application servers and the limited few with access to a VPN connecting to its subnet, good practise dictated immediate full revocation just in case
mgiannopoulosover 1 year ago
This my new personal record (3 days) between signing up for a service and getting a notice that my email address has been leaked :D
评论 #37336367 未加载
评论 #37338202 未加载
ttyyzzover 1 year ago
I don&#x27;t know but it always seems to be worded like in this instance: &quot;...A small subset of customers’ Sourcegraph license keys may have been accessed...&quot;<p>I don&#x27;t buy that, it always seems to me like an attempt to downplay something.
评论 #37338102 未加载
beanjuiceIIover 1 year ago
yikes, can i even trust this company now
评论 #37339292 未加载