3 ms·

When I have an expectation of privacy, say in a fenced backyard, I don't expect to be seen. It doesn't matter if it's a human or a robot commanded by a human t

When I have an expectation of privacy, say in a fenced backyard, I don't expect to be seen. It doesn't matter if it's a human or a robot commanded by a human that does the looking, it's still a violation of privacy. It's not really "private" if the backyard has a one way glass pane on one wall. Github should not be calling repos private if they're not.

snowwrestler 3y ago
This is one of many instances where developers should not make shallow assumptions without reading the documentation. GitHub is very clear about how private repos should be used. Edit to add: would you store your bank password on a piece of paper you always leave sitting in your backyard? Think carefully about your metaphor.
- owl57 3y ago
  > would you store your bank password on a piece of paper you always leave sitting in your backyard? Not that I'm advocating for checking passwords in git repos, Github or otherwise, but you metaphor depends on how rich you are and how bad is your neighborhood, I would think. My mom has definitely done exactly that — her medical conditions make it very hard to use bank apps without full daylight and also hard to bring the notebook home after every use — and I don't think that her password management choices, however frowned upon they may be here, have ever been a serious problem in practice.
kgermino 3y ago
Did you read the article? They’re not saying that GitHub is reading your repos, they’re saying that mistakes happen and you shouldn’t assume that private repos are secure. Go out in your fenced yard and assume you won’t be seen, but if you forget to close the gate someone might come back there anyway
floof 3y ago
I agree with the original comment -- github has secrets storage. There are also other secrets storage services that can be used out there. It's never a good idea to check in secrets in your code. Maybe the word "private" means different things to different users, but the fact that GitHub has a whole other set of features dedicated to "secrets" should be a giveaway to users that there is a distinction between "private" and "secret".

snowwrestler 3y ago

This is one of many instances where developers should not make shallow assumptions without reading the documentation. GitHub is very clear about how private repos should be used. Edit to add: would you store your bank password on a piece of paper you always leave sitting in your backyard? Think carefully about your metaphor.

owl57 3y ago
> would you store your bank password on a piece of paper you always leave sitting in your backyard? Not that I'm advocating for checking passwords in git repos, Github or otherwise, but you metaphor depends on how rich you are and how bad is your neighborhood, I would think. My mom has definitely done exactly that — her medical conditions make it very hard to use bank apps without full daylight and also hard to bring the notebook home after every use — and I don't think that her password management choices, however frowned upon they may be here, have ever been a serious problem in practice.

kgermino 3y ago

Did you read the article? They’re not saying that GitHub is reading your repos, they’re saying that mistakes happen and you shouldn’t assume that private repos are secure. Go out in your fenced yard and assume you won’t be seen, but if you forget to close the gate someone might come back there anyway

floof 3y ago

I agree with the original comment -- github has secrets storage. There are also other secrets storage services that can be used out there. It's never a good idea to check in secrets in your code. Maybe the word "private" means different things to different users, but the fact that GitHub has a whole other set of features dedicated to "secrets" should be a giveaway to users that there is a distinction between "private" and "secret".