3 ms·

It feels unsafe to store dot files in source control as the article mentions. Is this a common practice? They could contain sensitive information and I fear peo

It feels unsafe to store dot files in source control as the article mentions. Is this a common practice? They could contain sensitive information and I fear people might be tempted to push to GitHub. What about storing such files in a password manager/database?

lvass 4y ago
>contain sensitive information and I fear people might be tempted to push to GitHub Nothing can really protect someone from this level of insanity.
- politelemon 4y ago
  Anecdotal, I encounter it quite often at work among 'newer' developers, who have been doing this ever since Github private repos went free! That's why my question. Thanks for the answers everyone, it does come down to diligence and knowing what you're doing.
yoyohello13 4y ago
Many people have their dotfiles up on GitHub. As long as you're aware of what is in your dotfiles it pretty benign. Just put your passwords elsewhere.
marcinreal 4y ago
Just don't push to GitHub. :) You can also pick and choose what you want in the repos with this method. It's a very useful technique for tracking and rolling back changes to dotfiles that you care about. You can even make backups of the directory which can help you bootstrap new machines really quick. In a similar vein, I also have a git repo containing my todo list, journal, etc. and review and commit the changes once a week. Very helpful for catching accidental deletions/modifications. I have never been tempted to push these repos.
aidenn0 4y ago
There are plenty of tools to manage secrets in VCS, so that's always an option. As an aside, most programs now have a method to move sensitive information outside of the configuration file, so you can minimize what ends up in there.
layer8 4y ago
There are a number of possible solutions: git-remote-gcrypt: https://github.com/spwhitton/git-remote-gcrypt https://github.com/spwhitton/git-remote-gcrypt git-crypt: https://github.com/AGWA/git-crypt https://github.com/AGWA/git-crypt git-secret: https://github.com/sobolevn/git-secret https://github.com/sobolevn/git-secret However, most people who self-host their Git repository are fine with just transport-level encryption (TLS).
BrotherBisquick 4y ago
You simply don't push anything that has sensitive information in it. You pick and choose. Stow makes this easy, because the only things being pushed are files you explicitly move to a specific directory. Real world example: - Let's say I want to version control ~/.ssh/config and ~/.ssh/authorized_keys - I move these two files to ~/.dotfiles/ssh - ~/.dotfiles is version controlled, so I push the new files to gitlab. I'm only pushing two harmless files: my ssh configs, and authorized keys. Git, stow, and ~/.dotfiles don't see anything else. - After pushing, I run "stow ssh" inside ~/.dotfiles. This symlinks these two files to ~/.ssh I don't worry about pushing anything sensitive, because it's basically impossible for me to accidentally move something to ~/.dotfiles and then run 'git push.'

lvass 4y ago

>contain sensitive information and I fear people might be tempted to push to GitHub Nothing can really protect someone from this level of insanity.

politelemon 4y ago
Anecdotal, I encounter it quite often at work among 'newer' developers, who have been doing this ever since Github private repos went free! That's why my question. Thanks for the answers everyone, it does come down to diligence and knowing what you're doing.

yoyohello13 4y ago

Many people have their dotfiles up on GitHub. As long as you're aware of what is in your dotfiles it pretty benign. Just put your passwords elsewhere.

marcinreal 4y ago

Just don't push to GitHub. :) You can also pick and choose what you want in the repos with this method. It's a very useful technique for tracking and rolling back changes to dotfiles that you care about. You can even make backups of the directory which can help you bootstrap new machines really quick. In a similar vein, I also have a git repo containing my todo list, journal, etc. and review and commit the changes once a week. Very helpful for catching accidental deletions/modifications. I have never been tempted to push these repos.

aidenn0 4y ago

There are plenty of tools to manage secrets in VCS, so that's always an option. As an aside, most programs now have a method to move sensitive information outside of the configuration file, so you can minimize what ends up in there.

layer8 4y ago

There are a number of possible solutions: git-remote-gcrypt: https://github.com/spwhitton/git-remote-gcrypt https://github.com/spwhitton/git-remote-gcrypt git-crypt: https://github.com/AGWA/git-crypt https://github.com/AGWA/git-crypt git-secret: https://github.com/sobolevn/git-secret https://github.com/sobolevn/git-secret However, most people who self-host their Git repository are fine with just transport-level encryption (TLS).

BrotherBisquick 4y ago

You simply don't push anything that has sensitive information in it. You pick and choose. Stow makes this easy, because the only things being pushed are files you explicitly move to a specific directory. Real world example: - Let's say I want to version control ~/.ssh/config and ~/.ssh/authorized_keys - I move these two files to ~/.dotfiles/ssh - ~/.dotfiles is version controlled, so I push the new files to gitlab. I'm only pushing two harmless files: my ssh configs, and authorized keys. Git, stow, and ~/.dotfiles don't see anything else. - After pushing, I run "stow ssh" inside ~/.dotfiles. This symlinks these two files to ~/.ssh I don't worry about pushing anything sensitive, because it's basically impossible for me to accidentally move something to ~/.dotfiles and then run 'git push.'