Free Github SSH keys anyone?

Re:Free Github SSH keys anyone? by 0x0 on Thursday January 24, 2013 @03:17PM (#5111914)

It'd be a useful feature for github and bitbucket to have a default pre-commit that scans for probably-sensitive files and reject commits like that (maybe with a repo setting to opt out on the website, if you think you know what you're doing)

edit: In fact, they should probably run a full search for such files now and email a heads-up to users with repos that produce hits.

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by vellamike on Thursday January 24, 2013 @03:32PM (#5112021)

They might think of that as crossing a line - from just hosting and enabling you to do what you want to do to actually telling you what you want to do.

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by ef4 on Thursday January 24, 2013 @03:25PM (#5111965)

And remember folks, just deleting the file doesn't solve the problem, because this is a version control system.

Github has published instructions on how to actually purge sensitive data that's been accidentally committed: https://help.github.com/articles/remove-sensitive-data

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by Wilya on Thursday January 24, 2013 @03:19PM (#5111929)

We need a cross reference between this and Facebook graph search. For science.

(I flagged, also, because this should be told to the guys at Github, not out in the open.)

Oh, and of course, Google indexes them. Fantastic.

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by Kallikrates on Thursday January 24, 2013 @03:28PM (#5111990)

I shot github an email when the feature was first released their stance is that what is out in public, is out in public.

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by jrochkind1 on Thursday January 24, 2013 @03:27PM (#5111980)

This isn't new, presumably anyone who cared to exploit it would have already thought of:

https://www.google.com/search?q=site%3Agithub.com+inurl%3A.s...

Same thing, right?

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by mkhattab on Thursday January 24, 2013 @03:18PM (#5111915)

This is a big WTF moment for me. There are a ton of private keys here. I don't even know what else to say.

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by vellamike on Thursday January 24, 2013 @03:23PM (#5111957)

How exactly does this happen? I can understand that some people don't understand the need to keep their private key offline, but I would have thought those people aren't really aware of the existence of the private key...so how does it end up in a github repo?

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by leif on Thursday January 24, 2013 @03:24PM (#5111961)

    $ git add .ssh
    $ git commit

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by mkhattab on Thursday January 24, 2013 @03:26PM (#5111977)

It's probably more like:

   $ git add .
   $ git commit

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by kbar13 on Thursday January 24, 2013 @03:31PM (#5112007)

  # git add /
  # git commit -m 'omg im on the internet'

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by vellamike on Thursday January 24, 2013 @03:28PM (#5111987)

Yes but what is that key doing anywhere near the repository anyway?

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by Kallikrates on Thursday January 24, 2013 @03:26PM (#5111978)

Alternate source: https://www.google.com/search?q=BEGIN+RSA+PRIVATE+KEY&as...

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by Toddward on Thursday January 24, 2013 @03:19PM (#5111928)

I almost can't believe someone would commit their .ssh directory to a public GitHub repo.

Seriously - why? Your public key, sure, but the entire directory?

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by teilo on Thursday January 24, 2013 @03:29PM (#5111995)

In all likelihood, these are NOT the user's private SSH keys, but a key generated for the service that the user is developing - such as a key to run backups and issue remote commands. Thus I can well see that the key could be committed as part of an application stack.

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by mkhattab on Thursday January 24, 2013 @03:33PM (#5112030)

No, some of these repositories are user's dotfiles. See this for example, https://github.com/gomachan/dotfiles

There are many examples like this.

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by gavingmiller on Thursday January 24, 2013 @03:26PM (#5111976)

I purpose a corollary to Hanlon's razor: Never attribute to stupidity that which is adequately explained by ignorance?

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by kbar13 on Thursday January 24, 2013 @03:30PM (#5112006)

ignorance is almost always the explanation

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by ef4 on Thursday January 24, 2013 @03:28PM (#5111984)

The authorized_keys and known_hosts are nice to be able to share across machines.

But of course you also want to be real careful about authenticating them (a signed tag in Git can serve that purpose).

[ Parent | on HN ]

Re:Free Github SSH keys anyone? by j_s on Thursday January 24, 2013 @03:35PM (#5112041)

It would be interesting to find out what % are password-protected.

[ Parent | on HN ]