Hacker News Reader

Comment by p-e-w | Hacker News Reader

This post is mostly FUD. Case in point, the following advice:

> So, if you’re worried about it: stop putting sensitive data into private repositories.

Most of the issues mentioned in the post (misconfiguration, phishing, mistakes, zero-days) apply to all software, including non-cloud software. So the above advice is equivalent to "stop putting sensitive data into computers". It's run-of-the-mill popular-security nonsense that conveniently ignores that the alternatives come with their own risks, including security risks, and doesn't even attempt to perform a cost-benefit analysis.

Less of this stuff, please.

View on HN

I like to think myself as a pragmatic practitioner of security, and even I would say this isn't "popular-security nonsense". The "cost-benefit analysis" here equals: don't bloody do that, _obviously_.

If your system relies on secrets being present in repos, it is a poorly designed system. There is no scenario where this is necessary, other than one not wanting to put in the effort to inject secrets sensibly.

Yes, "the alternatives come with their own risks", but those risks are where the "cost-benefit analysis" equals "not worth the effort".

> If your system relies on secrets being present in repos, it is a poorly designed system.

Repos are databases that track changes in files, nothing more and nothing less. There are millions of repos on GitHub that don't contain application code.

Some people put their entire home directory in a Git repository. Home directories almost always contain secrets. That doesn't mean it's a bad idea, it just means the repo isn't meant for the eyes of others. In other words, it's a private repository.

People putting their entire home directory in a repo, on somebody else's shared computer and network, is going to end in a disaster scenario. This sounds like a bad idea.

> Most of the issues mentioned in the post

...are directly attributed to the cited GitHub incidents. I only scanned the article once but I saw no FUD in it.

Reply on news.ycombinator.com