Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH Keys on GitHub

github.com

Post reply on HN
Print view View original

11–20 of 48 posts

Re: SSH Keys on GitHub

#13

Post by benjarrell »

jethro_tell wrote: post #5
grhmc wrote: post #3

Earlier quoted context omitted.

No. There are valid cases to upload SSH keys and other certificates or secrets. Preventing it would be annoying, and near impossible to be very effective. Just my $0.02.

I agree with you, but I can't imagine a use case for a secret that's not secret.

There probably aren't many, howto and examples come to mind.

Re: SSH Keys on GitHub

#14

Post by nightmiles »

bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

It would be really cool if Github let users know when they are about to do something that is almost certainly a horrible mistake. However, is it their responsibility to stop them? I hope not. They provide a service that does exactly what it says on the box. Github shouldn't be obligated to prevent people from committing files that are otherwise valid and legal.

A better question would be: Could Github be successfully found liable for other users leaving their own keys in a public repository?

Re: SSH Keys on GitHub

#15

Post by nodesocket »

bagels wrote: post #2

Does Github have a responsibility to help people out with this kind of thing? What do you all think?

Responsibility? No, why would they. But.... I think it would be a great feature for GitHub to passively scan repos and look for common security oversights. They could then just send an e-mail notification about the issue.

Re: SSH Keys on GitHub

#17

Post by mikegirouard »

jethro_tell wrote: post #5
grhmc wrote: post #3

Earlier quoted context omitted.

No. There are valid cases to upload SSH keys and other certificates or secrets. Preventing it would be annoying, and near impossible to be very effective. Just my $0.02.

I agree with you, but I can't imagine a use case for a secret that's not secret.

I believe Vagrant uses (or previously used) an insecure, public keypair[0] to keep things simple.

Aside from things like that, I can't see it being a _common_ use case.

[0]: https://github.com/mitchellh/vagrant/tree/master/keys

Re: SSH Keys on GitHub

#18

Post by akerl_ »

I feel like this gets posted every other month or so. I appreciate the awareness, but it doesn't seem like there's much new discussion or debate to have on the matter: folks continue to be a bit more careless with credentials than they ought to be / don't think about what pushing something to a public site means / etc, it would rock if GitHub was more proactive about messaging affected users, it sucks that it's hard to safeguard against this via technical means.

If anything, I'd love to see somebody do a blog post instead about how they started scraping these results and/or the commit data firehose and messaging users who posted credentials

Re: SSH Keys on GitHub

#20

Post by __abc »

akerl_ wrote: post #18

I feel like this gets posted every other month or so. I appreciate the awareness, but it doesn't seem like there's much new discussion or debate to have on the matter: folks continue to be a bit more careless with credentials than they ought to be / don't think about what pushing something to a public site means / etc, it would rock if GitHub was more proactive about messaging affected users, it sucks that it's hard…

You want to be arrested as a "cyber terrorist"? Because that's how you get arrested as a "cyber terrorist" :)
Post reply on HN