Hacker News Reader

You can only limit the access. For example: limit access for other users than gitea to the config including sshd. Limiting the data that can be accessed with the databasepassword. Gitea doesn't need access to your wordpress. using an sso can also help: in this case gitea doesn't even have the password.

View on HN

If someone hack my linode, they can be gitea user?

I'm not sure I understand the concern. If they have shell access to your linode they already have access to everything - even if your db password were encrypted gitea can communicate with the db and so can any attacker coming from that system.

yes they can, but the risk is relative low. SSH-Auth should be only over keypairs,2fa should be on for your account and then most attacks should be unsuccessful.

I bought Yubikey recently. Should be usable

I will be doomed if there is RCE?

Golang is relative save in case of rces. The only problem is git with its hooks, but you need authentication to do harm. Gitea would rather crash than giving access to the attacker. git server are not really in danger.

Unless you have very private data in your private repos: no if you have your bankaccount password, your ssn or similar important data in your git repos: yes, but its your fault

Reply on news.ycombinator.com