search

diffix / explorer

Tool to automatically explore and generate stats on data anonymized using Diffix
MIT License
2 stars 1 forks source link

Sentry token should not be in repo! #218

Closed sebastian closed 4 years ago

sebastian commented 4 years ago

https://github.com/diffix/explorer/blob/master/src/explorer.api/appsettings.json#L14

Please rotate the token and make it something passed into the tool as an environment variable

dandanlen commented 4 years ago

I thought this too initially but after some research on the sentry forums it appears to be common practice to share this... https://forum.sentry.io/t/how-does-sentry-prevent-spammers/8188/2

dandanlen commented 4 years ago

Here is the forum post in question so you don't have to click through and scroll etc.

That’s pretty much the state of the art and there is no way to automatically prevent it. We haven’t heard of a practical issue with this. The much bigger spam-related problem people usually have are legitimate crashes that contain no information or that nobody cares about (“your app crashes a lot on Windows XP, here are 6k events”)

We allow you to filter events, e.g. ban IP addresses or certain app releases from sending events, but that’s primarily meant for buggy deployments of your own app, not because somebody maliciously used your DSN.

It is the same situation as with any other application identifying auth tokens. For example you can also extract oauth credentials from an official Twitter app and use them to access the Twitter API (which allows you to get much better rate limits and to pretend to be sending tweets from the official app)

dandanlen commented 4 years ago

Actually here is a better discussion https://forum.sentry.io/t/dsn-private-public/6297/2

TLDR;

You can create just a new DSN and delete old ones. You can find this in your project settings -> Client Keys.

Recommending storing the DSN somewhere private would be conflicting messaging from our side.

Let’s imagine you use @sentry/browser on your website, it’s impossible to hide the DSN in javascript. No one stops you from using the same DSN on your server.

So you see, we can’t make it secret so we don’t tell people it’s a secret, it’s basically an id identifying your account.

dandanlen commented 4 years ago

(Feel free to disagree btw.)

sebastian commented 4 years ago

Aha, I guess they have a point. Makes it easier to deploy explorer system too, so all things considered I guess it's not too bad then 👍