I have accidentally found that an known account with active, owner and posting keys have been pushed to official github branch for steem-python a few weeks back.

It has been deleted, but the source control records everything including deletion the whole file. Gareth Nelson commented:

wtf is a WIF for a known account doing in here? bye

It is an unwise practice to store keys/account information directly in the Python source code. And the account owner has obviously changed his keys after this incident.

The incident: https://github.com/steemit/steem-python/commit/5efacf62c56f859e8a1b6a99b55a26f548c6eecf

With no offence to point out the developer's mistakes, the main purpose is to what we can learn the lessons from this incident. So I have removed mentioning the developer.

今天晚上我在看官方 STEEM - PYTHON 库原代码 https://github.com/steemit/steem-python 的时候，无意发现了一个叫 Gareth Nelson 的人在一个目录下留下评论：

wtf is a WIF for a known account doing in here? bye

翻译过来就是：

竟然把一个我们知道帐号的WIF放上来？祝好运！

这是在 steemit/steem-python/tests/steem/test_steem.py 这个脚本里，不过现在在代码库里已经被删除了，只不过在github 代码控制里删除并不是真正意义的删除，代码管理其实还是会保留历史记录。

大家可以去围观： https://github.com/steemit/steem-python/commit/5efacf62c56f859e8a1b6a99b55a26f548c6eecf

我猜想，一定是开发者在本地测试的时候用的自己的帐号，因为从 test_steem.py 上（包含了几个测试用例），他把自己的三个重要的 key 都写在了PYTHON 原代码里：

可能那天他少喝了杯咖啡，结果一不小心就把代码提交了，并且 push 同步到远程 production 分支上了，结果发现的时候已经晚了，因为 github 会忠实记录所有的改变，包括删除也是一种改变。

不用想，开发者已经更改了这些 keys, 只不过，这是我们开发者一定得注意避免的，就是尽量不要把帐号密码写在代码里，实在一定要写的话，一定得用测试帐号，并且一定要把这些信息加密保存在文件里更安全一些。

这次泄露钥匙，有惊无险。

这篇文章的目的并不是指出开发者的问题，我们仅是讨论而已，就事论事，避免以后犯同样的错误。

Originally published at https://steemit.com Thank you for reading my post, feel free to Follow, Upvote, Reply, ReSteem (repost) @justyy which motivates me to create more quality posts.

原文首发于 https://Steemit.com 首发。感谢阅读，如有可能，欢迎Follow, Upvote, Reply, ReSteem (repost) @justyy 激励我创作更多更好的内容。

// Later, it may be reposted to my blogs: justyy.com, helloacm.com and codingforspeed.com 稍后同步到我的中文博客和英文计算机博客。

近期热贴

Recent Popular Posts

Tags: cn steemdev steemstem incident cn-programming

A SteemIt Development Incident - SteemIt 开发团队把一个70级的大鱼帐号拿来当测试 - 泄露钥匙，有惊无险

近期热贴

Recent Popular Posts