> Even if it is encrypted again before it's put onto the disk, fundamentally the key lives on the server (and has to in order to provide Github's feature set) a

> Even if it is encrypted again before it's put onto the disk, fundamentally the key lives on the server (and has to in order to provide Github's feature set) and so an attacker who had compromised the machine would simply grab the key before going after the files on disk. The actual additional security you get is really not that significant. It's not just compromised machines that you have to worry about -- that's what the higher layers of security are for: It's also: - poor disk decommissioning (e.g., your staff throws away disks without properly erasing them.) - poor machine management -- machines assigned to one owner, then moved to a new one. - bugs in storage management systems that leak data (e.g., block replicators, etc.) Also, note that the keys don't have to be on disk. Most cloud providers configure hosts to get keys via PXE boot, for exactly this reason. To be clear -- I don't disagree with you about thinking about the threat model, and in many cases it's not necessary to do this. But I do think that GitHub is now a very large player in an enterprise market, so I can't let them off so easily. :-)