I knew this was going to happen, i'm sure other goodies will be found too.
Private keys committed to Github repositories
11–20 of 31 posts
Re: Private keys committed to Github repositories
#12No, this is people committing their private keys to a Github repository. Github is not at fault. edit: submitter has since updated the title, was: "Github giving away your private key"
I would say it's shared responsability. Yes commiting private data is stupid, and the other hand, just testing the new sesarch by trying to search for rsa key could Have Avoided this. Anyway, as usual the main problem exist between the chair and the keyboard.
You could find these on Google (site:github.com id_rsa) before Github search, so I guess that Github search caused zero net harm.
Re: Private keys committed to Github repositories
#13Many of the items on that list are actually public keys, which should be perfectly safe to share to the world in a Git repo, but there are definitely a few private keys in there as well.
Re: Private keys committed to Github repositories
#14More than half those results are public keys. It's not as bad as first impressions would indicate.
Re: Private keys committed to Github repositories
#15I wonder if there's a case for a default pre-commit hook that greps for anything secret-looking such as ssh private keys, gpg keys, etc. and bails if it detects any.
Re: Private keys committed to Github repositories
#16Here is how to check if you ever committed your private SSH key by accident:
https://github.com/search?q=%40user-name-here+path%3A.ssh%2Fid_rsa&type=Code&ref=searchresultsRe: Private keys committed to Github repositories
#17Not just github: https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...
Re: Private keys committed to Github repositories
#18for those saying that github or git should have a default rule preventing private keys from being committed, I say:
lolwat?
private keys are private. these people -know- that they are pushing a git repo to a very public site. as such, they should recognize that * is going to be visible in their dotfiles repo. it's not git or github's fault that users are doin it wrong!
Re: Private keys committed to Github repositories
#19No, this is people committing their private keys to a Github repository. Github is not at fault. edit: submitter has since updated the title, was: "Github giving away your private key"
Seriously. It looks like people have added their private keys to (public!!!) repos, and voila, a search allows others to find that.
I had a dev send me his. I guess he doesn't understand the whole key-thing.
Now he doesn't log in to my server. Just sends me a zip-file that I unpack and test. sigh.
Re: Private keys committed to Github repositories
#20for those saying that github or git should have a default rule preventing private keys from being committed, I say: lolwat? private keys are private. these people -know- that they are pushing a git repo to a very public site. as such, they should recognize that * is going to be visible in their dotfiles repo. it's not git or github's fault that users are doin it wrong!
That's terrible logic, akin to Apple's "the iPhone 4 isn't defective, you're just holding it wrong." If a product is confusing your users, you should improve the UX to increase its usability.
Adding a default .gitignore file with some sensible defaults has no negative trade offs. If you really do want to commit your .ssh folder, just remove that line from your .gitignore.
I will admit that adding .DS_Store, while convenient, might be impractical since git is meant to be platform agnostic, and they probably don't want to start adding all sorts of platform-specific files.