I'm trying to help out a new user having problems accessing their DigitalOcean Kubernetes cluster. The question didn't have enough information, so I asked them to post their configuration file.
Perhaps it's my fault? Perhaps I should have been explicit about them not posting secrets.
Anyway, it's done now -- they posted their unredacted configuration file, with their real certificate authority data and their real server name and address... There isn't enough information there to give anyone immediate access, but it would make things a lot easier for a hacker and the contents of the file would certainly be classified as highly-sensitive if not actually secret.
I've advised them to take remedial action immediately and have flagged the post to the moderators to ask if there's anything they can do to help. But, this can't be a new problem so shouldn't there be a more standard way of dealing with this sort of thing? GitHub automatically informs you if you've accidentally disclosed secrets and tries to protect you in some way. Perhaps SO should at least have a way for a high-ranked or moderator user to actually hide a post if it seems to be detrimental to the poster.
What do you think?
certificate-authority-data
is only supposed to contain acceptable CA certificates, and these are usually all public knowledge anyway and contain only public keys. Thecertificate-authority-data
in that post looks hopelessly garbled anyway, but I'm not an expert on kubernetes configs. Of course real config info even without secrets is, as you note, a benefit to hackers. See also stackoverflow.com/questions/71444145/…