3 ms·

What he is doing should have been secure. The question is valid. How were the keys exposed from a private repo?

• pjc50 5y ago
  "Secure" is kind of a relative term, it only exists with regard to a threat model and a likely spectrum of attacks. Simply having the key in plaintext on a developer PC connected to the regular internet is fairly low-security to start with; there are all sorts of opportunities for coincidental compromise that may have exposed it directly from his PC or his collaborator's PC.
  • anm89 5y ago
    Agreed, all I'm saying is that he did not give any specific detail which demonstrated a specific vulnerability. so just feel like more info is needed.
• Hoasi 5y ago
  > What he is doing should have been secure. Sure, but using any third party is inviting a layer of risk. Banks get hacked too. No system is without vulnerabilities. You decide which to trust, including your potentially error-prone self.