4 ms·
Exec Summary: No actual changes to how the protocol itself works. Github is requiring modern keys + algorithms for git over SSH connections and removing the une
by er4hn 5y ago
Exec Summary: No actual changes to how the protocol itself works. Github is requiring modern keys + algorithms for git over SSH connections and removing the unencrypted git protocol as a connection option.
Seems reasonable to me. Since github is a git-as-a-service provider it makes sense to do this. From the headline I had thought they were making their own variant on the git protocol.
- mistrial9 5y agothe other side of this coin is that ssh key access is controlled and recorded more carefully, with more options to disable and ban.
- duskwuff 5y agoWhat are you trying to imply here? SSH is used to authenticate to GitHub as a specific user. GitHub can use this for access control and logging. This isn't new or surprising. If you don't want to authenticate to GitHub as a specific user, you can clone repositories over HTTPS. This isn't new either. You can't authenticate over HTTPS anymore, but if you were concerned about being "controlled and recorded", you weren't doing that anyway.
- TimWolla 5y ago> You can't authenticate over HTTPS anymore You can, just no longer using username and password. Instead you must use an access token.
- hunter2_ 5y agoFor accounts without MFA enabled (which are the only ones who were able to use username/password via https in the first place), is the token granted after supplying just username and password, and if so, what's the real improvement? I see here [0] a few benefits listed: > Unique – tokens are specific to GitHub and can be generated per use or per device > Revocable – tokens can can be individually revoked at any time without needing to update unaffected credentials > Limited – tokens can be narrowly scoped to allow only the access necessary for the use case > Random – tokens are not subject to the types of dictionary or brute force attempts that simpler passwords that you need to remember or enter regularly might be ...but if you can trivially obtain it by supplying username/password, then it's effectively equivalent anyway. [0] https://github.blog/2020-12-15-token-authentication-requirements-for-git-operations/ https://github.blog/2020-12-15-token-authentication-requirem...
- jfrunyon 5y agoYou can not obtain the username/password from the token.
- hunter2_ 5y agoAh, that makes sense, for the case of losing control of (e.g., accidentally committing) the git connection credentials: better to just revoke a token than rotate the password after having potentially also lost control of whatever else uses the same password.
- simonklitj 5y agoYup, and when you create a token they advise to give it an expiration date, just in case it ends up somewhere down the road.
- buu700 5y agoFrom the headline I had thought they were making their own variant on the git protocol. To be fair, extending, extending, and extinguishing does sound like something Microsoft might do.
- peakaboo 5y agoYup I was fully expecting this from the headline.
- buu700 5y ago(*embracing)
- pjmlp 5y agoOn the other hand, had Google bought Github instead, most likely the service would no longer exist.
- froh 5y agowhy do you think so?
- pjmlp 5y agoDo I really need to answer it? https://killedbygoogle.com/ https://killedbygoogle.com/ https://gcemetery.co/ https://gcemetery.co/
- dorianmariefr 5y agoOr it would be used by billions
- spixy 5y ago1. GitHub Inc. is independent from Microsoft 2. EEE is dead (at least in MS)