4 ms·
Don't trust corporate PR. They're obviously lying when they say "out of an abundance of caution". The private key was exposed in a public GitHub repo, it could
by tomp 4y ago
Don't trust corporate PR. They're obviously lying when they say "out of an abundance of caution". The private key was exposed in a public GitHub repo, it could literally be anywhere.
So MITM for some of 50m users is strictly better than MITM for all of 50m users.
- the_other 4y agoIt could be, but also GH might be logging inbound requests long enough to see whether the file was requested.
- deleted 4y ago[deleted]
- theteapot 4y ago> The private key was exposed in a public GitHub repo. How do you know this? Github runs scanner for private keys in public and private repos and notifies owner (I did it once so I know ... ;)). So some Github engineer likely would have received such an email if what you say is true. Hilarious.
- 3np 4y agoFrom the OP: > This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository.
- Veen 4y agoIt says exactly that in the article: > This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository Hilarious.
- theteapot 4y agoI didn't read it fully before commenting. I'm sorry.
- comprev 4y agoIf everyone read the entire article of each HN submission the comments section would be wildly different :-)
- adrr 4y agoI can’t see that could ever happen. Is the key just floating around on their employees computers and skeins accidentally committed it?
- roblabla 4y agoMaybe because the article says so? > This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository
- new2yc 4y agoAfter reading first paragraph, I was sure they don't have any specific reason to replace it. > leaked in public repo Me: Yeah, that's why they are doing it.