4 ms·

This could lead to a potential security issue. Imagine there's a misconfiguration in your dotfiles -- now it's public.

• dewey 8y ago
  There's a lot of dotfiles on Github and it doesn't seem to be a problem (Except if you check in private credentials, but that's not a problem unique to dotfiles). If you rely on your configuration to be secret to be secure it's just security by obscurity and not worth much anyway.
  • personjerry 8y ago
    > If you rely on your configuration to be secret to be secure it's just security by obscurity and not worth much anyway. What I had in mind is that the average person wouldn't be a target, but publicly declaring their security vulnerability would attract attacks they wouldn't receive otherwise.
    • intertextuality 8y ago
      Only key harvester bots on GitHub/etc would notice. If you’re being consciously attacked by someone then you have bigger problems to deal with. The solution isn’t particularly hard either, simply source a secrets file and make sure you add that to the gitignore file.
• jdormit 8y ago
  Who says your git repo has to be public? Use a GitHub private repo, host the repo yourself behind SSH on a $5 Digital Ocean droplet, use the free private repos that come with Gitlab.com... securing git repositories is a solved problem.
• thingfox 8y ago
  This is why i recommend not committing actual dotfiles but committing templates instead. Yadm, a thin wrapper around git allows for alternate files, encryption and templating. See my post https://news.ycombinator.com/item?id=19594859 https://news.ycombinator.com/item?id=19594859 https://github.com/thingfox/dotfiles https://github.com/thingfox/dotfiles https://yadm.io/docs/encryption https://yadm.io/docs/encryption https://yadm.io/docs/bootstrap https://yadm.io/docs/bootstrap https://yadm.io/docs/alternates https://yadm.io/docs/alternates