Re:Travis CI acquired by Idera
by ivan4th on Wednesday January 23, 2019 @11:34AM
(#18979712)
There used to be a catch, though, don't know if it's already fixed. If you use this ssh debugging feature you make your secrets world-accessible (anyone can connect to ssh and grab them). This was one of the reasons why I switched to CicleCI, actually (besides their Workflows).
[ Parent
| on HN ]
Yes, it is indeed correct that if somebody grabs the ssh command with the key while you are debugging, it is accessible. It's something that we want to address in a better way, but other priorities are present right now (build image updates, performance improvements, some new features that we haven't announced yet.) Still, the feedback is appreciated!