Free Github SSH keys anyone?

#1

Post by TjWallas » Thu, Jan 24, 2013, 8:08 PM UTC

Re: Free Github SSH keys anyone?

#2

Post by 0x0 » Thu, Jan 24, 2013, 8:17 PM UTC

It'd be a useful feature for github and bitbucket to have a default pre-commit that scans for probably-sensitive files and reject commits like that (maybe with a repo setting to opt out on the website, if you think you know what you're doing)

edit: In fact, they should probably run a full search for such files now and email a heads-up to users with repos that produce hits.

Re: Free Github SSH keys anyone?

#3

Post by mkhattab » Thu, Jan 24, 2013, 8:18 PM UTC

This is a big WTF moment for me. There are a ton of private keys here. I don't even know what else to say.

Re: Free Github SSH keys anyone?

#4

Post by Toddward » Thu, Jan 24, 2013, 8:19 PM UTC

I almost can't believe someone would commit their .ssh directory to a public GitHub repo.

Seriously - why? Your public key, sure, but the entire directory?

Re: Free Github SSH keys anyone?

#5

Post by Wilya » Thu, Jan 24, 2013, 8:19 PM UTC

We need a cross reference between this and Facebook graph search. For science.

(I flagged, also, because this should be told to the guys at Github, not out in the open.)

Oh, and of course, Google indexes them. Fantastic.

Re: Free Github SSH keys anyone?

#6

Post by vellamike » Thu, Jan 24, 2013, 8:23 PM UTC

How exactly does this happen? I can understand that some people don't understand the need to keep their private key offline, but I would have thought those people aren't really aware of the existence of the private key...so how does it end up in a github repo?

Re: Free Github SSH keys anyone?

#7

Post by leif » Thu, Jan 24, 2013, 8:24 PM UTC

vellamike wrote: post #6

How exactly does this happen? I can understand that some people don't understand the need to keep their private key offline, but I would have thought those people aren't really aware of the existence of the private key...so how does it end up in a github repo?

    $ git add .ssh
    $ git commit

Re: Free Github SSH keys anyone?

#8

Post by ef4 » Thu, Jan 24, 2013, 8:25 PM UTC

And remember folks, just deleting the file doesn't solve the problem, because this is a version control system.

Github has published instructions on how to actually purge sensitive data that's been accidentally committed: https://help.github.com/articles/remove-sensitive-data

Re: Free Github SSH keys anyone?

#9

Post by joeycfan » Thu, Jan 24, 2013, 8:25 PM UTC

Toddward wrote: post #4

I almost can't believe someone would commit their .ssh directory to a public GitHub repo. Seriously - why? Your public key, sure, but the entire directory?

The thing that kicks my ass is that the people who did this are pulling in 6 figures for their job. And they suck.

Re: Free Github SSH keys anyone?

#10

Post by gavingmiller » Thu, Jan 24, 2013, 8:26 PM UTC

Toddward wrote: post #4

I almost can't believe someone would commit their .ssh directory to a public GitHub repo. Seriously - why? Your public key, sure, but the entire directory?

I purpose a corollary to Hanlon's razor: Never attribute to stupidity that which is adequately explained by ignorance?