Web3 developer Brian Guan lost $40,000 after accidentally making his wallet keys public on GitHub.
  • Web3 developer Brian Guan lost $40,000 after accidentally posting his wallet’s secret keys publicly on GitHub, with the funds being drained in just two minutes.
  • The crypto community’s reactions were mixed, with some offering support and others mocking Guan’s previous comments about developers using AI tools like ChatGPT for coding.
  • This incident highlights ongoing debates about security practices and the role of AI in software development within the crypto community.
  • darklamer@lemmy.dbzer0.comEnglish
    6·
    28 days ago

    The developer said he forgot that his secret keys were in the repository.

    If you have your secret keys in your repository you’ve already fucked up, long before you accidentally make that repository public.

    • BrianTheeBiscuiteer@lemmy.worldEnglish
      3·
      28 days ago

      One of the first things you should do in a repo is add a .gitignore file and make sure there are rules to ignore things like *secret* or *private* etc. Also, I pretty much never use git add . because I don’t like the laziness of it and EVERY TIME one of my coworkers checked in secrets they were using that command.

      • lurch (he/him)@sh.itjust.worksEnglish
        2·
        28 days ago

        Even though that’s a good extra precaution, per person config data, such as keys, should be stored outside of the repo, eg. in the parent directory or better in the users home dir. There is zero reason to have it in the repo. Even if you use a VM/containers, you can add the config in an extra mount/share.

      • sugar_in_your_tea@sh.itjust.worksEnglish
        1·
        25 days ago

        git add -u is pretty nice, it only adds modified files.

        I usually do git add -p which is interactive (helps avoid committing debugging prints and whatnot), but the other is nice for bigger refactors.

      • JimmyMcGill@lemmy.worldEnglish
        1·
        27 days ago

        I basically always do a git add -p

        Very useful command and it works with other git commands as well.

        Everytime a colleague asks me for help with git that’s the one rule I suggest them to use.

          • PumaStoleMyBluff@lemmy.worldEnglish
            1·
            27 days ago

            Instead of just adding whole changed files, it starts an interactive mode where it shows every hunk of diffs one by one, and asks you to input yes or no for each change. Very helpful for doing your own mini code review or sanity check before you even commit.