Scanning 7.25M Public Repositories on China's Largest Git Platform for Secrets(www.mongodb.com)
24 pointsby kernelrocks6 hours ago3 comments
  • gosenan hour ago
    Surprised the gap is that small! 3.64 vs 3.11 per 1k repos

    I'd have expected Gitee to be way worse with no scanning partnerships at all.. would be curious to see GitHub in that table, to know how much push protection actually changes that number

  • nitroedge5 hours ago
    So what happens if someone uses some of these credentials and enjoys free AI for as long as they are active? Just curious if this is is criminally enforced now and what the penalties have been?

    I remember there was a site awhile ago that listed Ollama instances which were made open to the public and had the # of tokens/sec throughput beside each one.

  • dorianmariecom5 hours ago
    same on github or gitlab etc
    • poly2it5 hours ago
      They compare this in the article:

        Platform  | Repos scanned | Verified-live credentials | Per 1K repos
  ----------+---------------+---------------------------+-------------
  Bitbucket |    ~2,600,000 |                     6,212 |         2.39
  GitLab    |    ~5,600,000 |                    17,430 |         3.11
  Gitee     |     7,256,531 |                    26,400 |         3.64
      • LoganDark5 hours ago
        I wonder if this is because of providers scanning those platforms more than they scan Gitee, or the platforms themselves notifying the providers. Fairly sure that GitHub, for example, supports spotting certain live credentials on push and immediately notifying the platform to revoke it. And plenty of providers also watch the open web for live tokens and revoke them immediately.
        • owlninja5 hours ago
          From the article

          > It has no public equivalent of the platform-vendor secret-scanning partnerships that have become standard on GitHub.