Hacker Newsnew | past | comments | ask | show | jobs | submit | roidrage's commentslogin

That wouldn't be possible, and that's independent of the security issue we've disclosed in the post.

For pull requests Travis CI has long had security measures in place to prevent this scenario from happening: https://docs.travis-ci.com/user/pull-requests#Pull-Requests-...


Doesnt this still make it potentially available in case some malicious/unmalicious coder leaves some console debugging out?


Only if you merge it in. The point is the secure environment variables are not available at all in the fork build. The bash oneliner they show is to help you run scripts which won't crash if they don't have those env vars available, not to "hide them" by running a test script which doesn't use them.


I know many instances where code reviews didnt catch log statement in huge binaries.


Right, but now you're in the "review of a PR didn't catch malicious code" boat. At which point, you've got bigger problems than leaking env vars in your CI.

Not to dismiss it---it's just a different point.


Thank you for your kind words, they're very humbling and flattering for us, and they are what keep us going. It's a great boost for us that people suggest GitHub should buy us. Thank you!

Thank you for your suggestions as well, it's something we've been thinking about ourselves as well, independently of whether it's a part of GitHub or an independent project/product.

We've been working hard on making Travis CI available for building private GitHub repositories, and we're coming along quite nicely. Stay tuned! :)

Mathias/Travis CI


The Travis Pro edition has been being used actively by customers for almost two months now, we're just not making a big fuss about it because we focus on ironing out kinks :)

If you're interested, you're more than welcome to get in touch with us (mathias@travis-ci.com).

Mathias/Travis CI


In the article I wrote that there was no guarantee the book would be a success. The reason for that is that I didn't have any validation upfront whether the book is a good and viable product idea or not. I started work on it long before I joined the 30x500 class, and how the book came about is not exactly in the spirit of it, as it takes a whole different approach on finding audiences for products and all that.

The total time that went into the book is hard to put a number on. I'd say at least three months of dedicated writing, testing out theories in practice, editing, proof-reading and building up marketing momentum around it went into the book.


Thank you so much for the kind words. I'm really glad you're finding the book this helpful!

Now, about the Node client. You are correct that there's been stalling over the last six or more months, but there's work on continuing the work on it, adapting it to new features in Riak and to push Frank's (original author) work on rewriting it in pure JavaScript towards the finish line.

Thanks again, your comment is very much appreciated!


Sure can. I actually wrote a post about how I'm building and publishing the book a while back which has more details on the fulfillment provider as well: http://www.paperplanes.de/2012/1/12/my-publishing-tool-chain...


It was that snarky comment on my first post on "awesome" and "lifestyle" (although I thought I'd make pretty clear that I don't consider Redis a lifestyle) that made me write this second one. I'm glad it helped clarify some things.


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: