Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Keys on GitHub

github.com

Post reply on HN
Print view View original

1–10 of 48 posts

Re: SSH Keys on GitHub

#3

Post by grhmc »

bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

No. There are valid cases to upload SSH keys and other certificates or secrets. Preventing it would be annoying, and near impossible to be very effective.

Just my $0.02.

Re: SSH Keys on GitHub

#5

Post by jethro_tell »

grhmc wrote: post #3
bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

No. There are valid cases to upload SSH keys and other certificates or secrets. Preventing it would be annoying, and near impossible to be very effective. Just my $0.02.

I agree with you, but I can't imagine a use case for a secret that's not secret.

Re: SSH Keys on GitHub

#6

Post by sluzorz »

bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

I don't think they remove it. I do believe that they send an automated email if they detect private keys from being committed to a public repo though. Amazon does something similar to this and they even revoke the key if they see that its public.

Re: SSH Keys on GitHub

#7

Post by stephenhuey »

bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

Amazon does help with it. A friend of mine recently went through a newbie programmer class and forgot the teacher instructed them to keep their AWS SSH keys out of their repo and within a 20-hour period someone racked up tens of thousands of dollars in EC2 charges! Amazon kindly refunded the entire bill.

Re: SSH Keys on GitHub

#8

Post by jvoorhis »

grhmc wrote: post #3
bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

No. There are valid cases to upload SSH keys and other certificates or secrets. Preventing it would be annoying, and near impossible to be very effective. Just my $0.02.

Certificates are not secrets.

Re: SSH Keys on GitHub

#9

Post by swozey »

jethro_tell wrote: post #5
grhmc wrote: post #3

Earlier quoted context omitted.

No. There are valid cases to upload SSH keys and other certificates or secrets. Preventing it would be annoying, and near impossible to be very effective. Just my $0.02.

I agree with you, but I can't imagine a use case for a secret that's not secret.

They could be pointing to an environment variable or a number of things. I'm not sure if there's a good way for Github to deal with things like that without affecting at least some users.

edit:..I guess they could just validate that it's a key.

Post reply on HN