GitHub Private Repos Considered Private-Ish

Re:GitHub Private Repos Considered Private-Ish by ghusto on Sunday June 04, 2023 @09:59AM (#36185664)

I like to think myself as a pragmatic practitioner of security, and even I would say this isn't "popular-security nonsense". The "cost-benefit analysis" here equals: don't bloody do that, _obviously_.

If your system relies on secrets being present in repos, it is a poorly designed system. There is no scenario where this is necessary, other than one not wanting to put in the effort to inject secrets sensibly.

Yes, "the alternatives come with their own risks", but those risks are where the "cost-benefit analysis" equals "not worth the effort".

[ Parent | on HN ]

Re:GitHub Private Repos Considered Private-Ish by p-e-w on Sunday June 04, 2023 @10:17AM (#36185772)

> If your system relies on secrets being present in repos, it is a poorly designed system.

Repos are databases that track changes in files, nothing more and nothing less. There are millions of repos on GitHub that don't contain application code.

Some people put their entire home directory in a Git repository. Home directories almost always contain secrets. That doesn't mean it's a bad idea, it just means the repo isn't meant for the eyes of others. In other words, it's a private repository.

[ Parent | on HN ]

Re:GitHub Private Repos Considered Private-Ish by ghusto on Sunday June 04, 2023 @01:12PM (#36187352)

People putting their entire home directory in a repo, on somebody else's shared computer and network, is going to end in a disaster scenario. This sounds like a bad idea.

[ Parent | on HN ]