3 ms·
I like to think myself as a pragmatic practitioner of security, and even I would say this isn't "popular-security nonsense". The "cost-benefit analysis" here eq
by ghusto 3y ago
I like to think myself as a pragmatic practitioner of security, and even I would say this isn't "popular-security nonsense". The "cost-benefit analysis" here equals: don't bloody do that, _obviously_.
If your system relies on secrets being present in repos, it is a poorly designed system. There is no scenario where this is necessary, other than one not wanting to put in the effort to inject secrets sensibly.
Yes, "the alternatives come with their own risks", but those risks are where the "cost-benefit analysis" equals "not worth the effort".
- p-e-w 3y ago> If your system relies on secrets being present in repos, it is a poorly designed system. Repos are databases that track changes in files, nothing more and nothing less. There are millions of repos on GitHub that don't contain application code. Some people put their entire home directory in a Git repository. Home directories almost always contain secrets. That doesn't mean it's a bad idea, it just means the repo isn't meant for the eyes of others. In other words, it's a private repository.
- ghusto 3y agoPeople putting their entire home directory in a repo, on somebody else's shared computer and network, is going to end in a disaster scenario. This sounds like a bad idea.