entelarust's comments

On: Tell HN: GitHub no longer supporting unauthenticat...

[entelarust]

Had a fun time today updating requirements.txt, git submodule refs and forking old dependancies of dependancies that havent updated their repos yet =| Inception!

On: Show HN: FalsiScan – Make it look like a PDF has b...

[entelarust]

TIL about the WTFPL license ;) http://www.wtfpl.net/about/

On: How is China able to provide enough food to feed o...

[entelarust]

Those sat shots totally remind me of the intro to the blade runner where they show the densely packed structures https://i2.wp.com/rosettedelacroix.com/wp-content/uploads/20...

On: Windows 93 (2014)

[entelarust]

needs sheep.exe

On: Windows 93 (2014)

[entelarust]

Needs sheep.exe

On: Ask HN: Affiliate management solutions?

[entelarust]

http://www.hasoffers.com/

On: Prose, a content editor for GitHub

[entelarust]

Use this all the time to update READMEs and documentation

Great, clean interface

[dominotw → entelarust]

Could you tell me how this differs from githubs own markdown editor. I played with this for a bit but I failed to notice anything.

On: CircleCI raises $6m Series A

[entelarust]

congrats!

my team and i are big fans of your product

On: CircleCI security incident

[entelarust]

Quick theoretical senario...

User signs up to try circleci for a private project of theirs. Grants read access to their private repos via github oauth

User also has many other private repos (company they work for, open source projects, forks, etc)

Could they have used the stored github credentials from circleci to clone every private repo in full the user had access to?

[xentronium → entelarust]

Github has a feature to allow access to a singular repository via a key. It would be logical for CircleCI to use that feature, although I'm not sure they actually did.

https://help.github.com/articles/managing-deploy-keys#deploy...

[johnwards → xentronium]

I'm pretty sure that Circle uses the oAuth api to checkout repos, the deploy key part on github they use for their deployment feature.

If the attacker has a bunch of tokens, could they have bulk downloaded source code before the oAuth stuff was revoked by Circle?

https://github.com/blog/1270-easier-builds-and-deployments-u...

[gravitronic → xentronium]

They did not.

[j15e → gravitronic]

They did, Circle-CI client here.

Info have a Circle-CI deploy key per private repository (which I will revoke).

[hkdobrev → entelarust]

In theory it is possible.

On: How do you log your events and exceptions

[entelarust]

Our app is based on django + javascript

We use getsentry.com and its great