3 ms·

god beware if your open source project needs a single private repository to share passwords between admins for example or private config for your webserver. Sud

god beware if your open source project needs a single private repository to share passwords between admins for example or private config for your webserver. Suddenly you see yourself at 394$ compared to the 7$ you paid before.

pc86 10y ago
> a single private repository to share passwords between admins Please tell me you're kidding.
morgante 10y ago
> beware if your open source project needs a single private repository to share passwords Passwords emphatically do not belong in git. Your private repos should be maintained such that accessing them would not compromise your security.
- beberlei 10y ago
  if you share Ansible inventory files that are encrypted with ansible-vault, then this is not happening. But i still wouldn't want to have a public repository with the files and the metadata of servers that is clearly not meant for public consumption. Let me brig another example for OSS projects that could need a private repository: branches for security fixes that are not public yet.
  - alxndr 10y ago
    > "branches for security fixes that are not public yet" A private git server would probably be better for that, but also wouldn't cost $0.
CameronBanga 10y ago
I hope that any team using github to share passwords is driven to move away from that method because of this price change. That's a bad bad idea.
- brianwawok 10y ago
  Why? If it is Encrypted in ansible vault or something it's not a terrible way to keep your creds.
  - frostymarvelous 10y ago
    I think that wasn't clear initially. But granted, valid point.
  - morgante 10y ago
    If they're encrypted, you can put them in a public repo.
    - brianwawok 10y ago
      Call it overkill, but I would see no reason not to go both private repo + encrypted creds. Is ansible vault encryption brute force proof? I have no idea. I could spend an hour and figure out. But why not just follow decent engineering principles and double lock my door?
  - frostymarvelous 10y ago
    What's wrong with using Dropbox or something like that?

pc86 10y ago

> a single private repository to share passwords between admins Please tell me you're kidding.

morgante 10y ago

> beware if your open source project needs a single private repository to share passwords Passwords emphatically do not belong in git. Your private repos should be maintained such that accessing them would not compromise your security.

beberlei 10y ago
if you share Ansible inventory files that are encrypted with ansible-vault, then this is not happening. But i still wouldn't want to have a public repository with the files and the metadata of servers that is clearly not meant for public consumption. Let me brig another example for OSS projects that could need a private repository: branches for security fixes that are not public yet.
- alxndr 10y ago
  > "branches for security fixes that are not public yet" A private git server would probably be better for that, but also wouldn't cost $0.

CameronBanga 10y ago

I hope that any team using github to share passwords is driven to move away from that method because of this price change. That's a bad bad idea.

brianwawok 10y ago
Why? If it is Encrypted in ansible vault or something it's not a terrible way to keep your creds.
- frostymarvelous 10y ago
  I think that wasn't clear initially. But granted, valid point.
- morgante 10y ago
  If they're encrypted, you can put them in a public repo.
  - brianwawok 10y ago
    Call it overkill, but I would see no reason not to go both private repo + encrypted creds. Is ansible vault encryption brute force proof? I have no idea. I could spend an hour and figure out. But why not just follow decent engineering principles and double lock my door?
- frostymarvelous 10y ago
  What's wrong with using Dropbox or something like that?