3 ms·

Is there a disadvantage to banning private keys in public repos?

• ATsch 9y ago
  Well, misdetection and examples for one.
• Artemis2 9y ago
  I personally upload private keys in repos for some test scenarios and examples (dummy private keys of course). I often don’t want to write a test harness to generate the data for each run. Sue me!
• demarq 9y ago
  Yes, business wise github is a git hosting site. If they started implementing rules on how you structure your application customers would get frustrated and move away. Just to be clear, I'm not suggesting a ban at all, just a friendly email in response to commits that introduce credentials to public repos
• tyingq 9y ago
  A fair amount of the google hits are for test certs that allow the test suite for the software to run.
• jcranmer 9y ago
  People already mentioned the major use case of testing, but building a blacklist of keys (e.g., the Debian OpenSSL there-are-only-64K-keys fiasco) is a plausible option as well.
• kemitche 9y ago
  Test keys, example keys for documentation, etc. I'd be all for an optional, branch protection-like feature though.
  • rwmj 9y ago
    Is there a problem generating them? It's essentially just a single ‘ssh-keygen’ command, see eg: https://github.com/libguestfs/libguestfs/blob/master/p2v/Makefile.am#L323-L337 https://github.com/libguestfs/libguestfs/blob/master/p2v/Mak...