4 ms·
It’s right there in the name: GitHub private repos are “private,” not “secure” or “secret”. That name was chosen purposefully. When we moved our code from priv
by snowwrestler 3y ago
It’s right there in the name: GitHub private repos are “private,” not “secure” or “secret”. That name was chosen purposefully.
When we moved our code from privately hosted SVN to GitHub 10+ years ago, folks at GitHub were quite clear that we should not trust private repos with secrets like private keys or passwords.
So why have private repos at all? It is to allow control of collaborators. GitHub originally allowed everyone to see and fork every repo—a true open source approach. Private repos were added basically so corporate codebase managers would not have to spend tons of time rejecting random PRs and responding to random people.
For a LOT of private software projects, everything secret can be easily stored in the database, environments, or a dedicated tool for managing secrets. GitHub private repos are great for those. If my entire codebase is a highly sensitive trade secret, I would not use GitHub private repos, personally.
- willis936 3y agoWhen I have an expectation of privacy, say in a fenced backyard, I don't expect to be seen. It doesn't matter if it's a human or a robot commanded by a human that does the looking, it's still a violation of privacy. It's not really "private" if the backyard has a one way glass pane on one wall. Github should not be calling repos private if they're not.
- snowwrestler 3y agoThis is one of many instances where developers should not make shallow assumptions without reading the documentation. GitHub is very clear about how private repos should be used. Edit to add: would you store your bank password on a piece of paper you always leave sitting in your backyard? Think carefully about your metaphor.
- owl57 3y ago> would you store your bank password on a piece of paper you always leave sitting in your backyard? Not that I'm advocating for checking passwords in git repos, Github or otherwise, but you metaphor depends on how rich you are and how bad is your neighborhood, I would think. My mom has definitely done exactly that — her medical conditions make it very hard to use bank apps without full daylight and also hard to bring the notebook home after every use — and I don't think that her password management choices, however frowned upon they may be here, have ever been a serious problem in practice.
- kgermino 3y agoDid you read the article? They’re not saying that GitHub is reading your repos, they’re saying that mistakes happen and you shouldn’t assume that private repos are secure. Go out in your fenced yard and assume you won’t be seen, but if you forget to close the gate someone might come back there anyway
- floof 3y agoI agree with the original comment -- github has secrets storage. There are also other secrets storage services that can be used out there. It's never a good idea to check in secrets in your code. Maybe the word "private" means different things to different users, but the fact that GitHub has a whole other set of features dedicated to "secrets" should be a giveaway to users that there is a distinction between "private" and "secret".
- gymbeaux 3y agoI don’t think it was “chosen very carefully”- the other word is “public”, and it refers mainly to who has access to the repo. Public and private are the ideal words imo