11 ms·

Great news. I got flamed a month ago [1] for noting how difficult it is to get up and running on GitHub in the Windows world, where things like generating SSH

Great news. I got flamed a month ago [1] for noting how difficult it is to get up and running on GitHub in the Windows world, where things like generating SSH keys aren't exactly part of the daily routine. Glad to hear that they were listening. [1] http://news.ycombinator.com/item?id=3871699 http://news.ycombinator.com/item?id=3871699

drivebyacct2 14y ago
"Scary crypto stuff"? So you don't understand how PKI works and you're trying to use distributed source control? (I say this not to be a jerk, but because there aren't exactly a wealth of good alternatives given it is a distributed source control mechanism. PKI comes with the territory and an SSH key generation is part of that) GitHub doesn't take any more setup than a standard Git setup takes (well, outside of signing up, a very short process anyhow). Install the Git client via the Windows installer, (point and click, a minute, tops). Generate an SSH key. Upload the id_rsa.pub. Done. I mean, it would be one thing if they left users in the dark about this, but I'm fairly sure that the "Thanks for signing up page" links directly to the OS-specific meticulous step-by-step instructions of generating the key. I'm not sure you understand what it means to be flamed. Every one of the comments is specific about your misconceptions and why signing up for a GitHub account is as trivially easy as signing up for a Twitter account. (Using GitHub as an oAuth account does not require actually uploading a public key)
- ctz 14y ago
  PKI has nothing to do with SSH keys. Github's use of SSH does not use certificates, and github has no certification infrastructure.
  - drivebyacct2 14y ago
    My apologies, I abuse "PKI" to mean "PK infrastructure" (which I know is what the acronym stands for, I'm making a bit of tongue-in-cheek commentary), I think it's silly that PKI implicitly means CAs but according to Wikipedia at least, you're correct.
    - nknight 14y ago
      No, he isn't, and the relevant Wikipedia article is very poorly written. PKI is a highly generic term. Webs of trust are just as much a PKI as a certificate-based system. Everything you've said in this thread has been bang-on, and the replies you're getting are deeply depressing.
      - toddheasley 14y ago
        Can we at least agree that if we attempted a list of all the Xs a programmer needs to know before doing Y and made it law that nobody could write any software at all?
        rbanffy 14y ago
        Understanding key pairs is very basic knowledge. I don't expect people to understand everything, but things like this, I do. It's dangerous not to.
- eli 14y ago
  For many people there Github = git, so saying github isn't much harder to set up than Git isn't saying much. Using git on Windows has historically not been super fun. The CLI installer mostly works, but it's pretty clunky. Cygwin works fine too, but it's also not especially elegant. At the very least, known of these solutions conform to the expectations of people of the platform. The GUI clients on Windows last I looked (a year ago) were pretty terrible, especially compared to TortoiseSVN, which isn't bad. OS X, on the other hand, had several very nice GUI clients even before the official Github client came out.
  - drivebyacct2 14y ago
    I don't know what difference the "Github = git" distinction makes, from an oAuth perspective it still seems implicitly obvious to me that completing the signup and adding SSH keys are distinct tasks. As for "CLI installer" (I presume you mean the installer for the CLI git client), and Cygwin, I'm not sure what to say. I've used the Git installer dozens of times without problem, there aren't exactly tons of places for it to go wrong. Are there specific or particular issues you have with it? I do indeed forget that some programmers manage to make it far resisting learning to use the command line. Even with step-by-step instructions. I guess at some people I'm willing to fault the developer rather than tools that are powerful that come with good documentation.
    - thmcmahon 14y ago
      Essentially what you're saying is that you understand it; therefore it's simple to understand. Obviously GitHub believe there are people who will benefit from using Git who can't be bothered understanding setting up ssh. Seems reasonable to me.
      - drivebyacct2 14y ago
        I think you're right and I guess that's what I'm beginning to realize. I just kind of assumed that in that case... Git is the wrong tool for their job. If you don't need the "power of Git" (I swear, I'm not in love with Git), then use Dropbox or SVN or something simpler. Seems easier than fighting with keys, and then fighting with git's distributed nature and then fighting with all of the complexities of merging and conflicts. Haha, maybe another of way of putting things from my perspective, I found keys to be the least of my concerns once I got into projects that really used Git and I have a hard time seeing people be successful with Git if the keygen steps throws them off. I hope that explains things from a different perspective :)
- andybak 14y ago
  I get really sick of this attitude. None of us want to understand every single domain of knowledge from set theory or quantum physics up to cosmology or social psychology. I personally have been forced to learn more low-level Unixy things than I ever wanted to. I want to write simple and elegant front and back end code quickly so I can spend my spare time honing UX and other human-facing aspects of my work. I resent being flamed because I don't fully understand the subtleties of zsh or nginx or or whatever other shiny toy someone else happens to find essential knowledge. Your world might not necessarily be mine.
  - wnoise 14y ago
    > None of us want to understand every single domain of knowledge from set theory or quantum physics up to cosmology or social psychology. Speak for yourself. All of those are fascinating.
    - extesy 14y ago
      Speak for yourself. They are fascinating for you, but not for me or many other people.
    - andybak 14y ago
      Actually. I agree with you (apart from the fact that I haven't had a chance to learn much about social psychology). I was just trying to think of examples of disciplines at opposite ends of an imagined continuum.
  - drivebyacct2 14y ago
    You can't follow 3 step-by-step instructions, insult me by implying I'm flaming and then drudge up completely unrelated tools in a discussion about ssh-keygen? What do you people want? Seriously? Yes, I'd love to have a big red easy button. It could autoconfigure MySQL, and write init scripts, configure deploy environments because apache conf files are too complicated to learn. Hell, it could even write my backend code and then commit it for me too! I'm done with this ludicrous conversation. I've never seen such an ignorant-excusing entitled discussion in a "technical" community before. Downvote me because you can't follow steps or can't be bothered to learn how to use one of your most important development tools, I've lost interest.
- ncarlson 14y ago
  > "Scary crypto stuff"? So you don't understand how PKI works and you're trying to use distributed source control? Is this an honest question, or are you alluding to the idea that someone who doesn't understand PKI should not use distributed source control?
  - uxp 14y ago
    Well, in the original quote that was cited from "scary crypto stuff" was surrounded with: Last I checked they[GitHub] made you perform a bunch of scary crypto stuff on your local machine before they'd let you in. If performing `ssh-keygen` and entering in an (optional) password from a command line constitutes "scary crypto", then maybe Git and GitHub isn't for everyone. Not that anyone needs to know how PKI works, but they might be better off knowing that `ssh-keygen` generates an ssh key pair, a pretty essential component of the `git` workflow. Maybe that's why SVN is so strong in older development shops. Outside of the effort required to convert an SVN repo to a Git repo, all those developers already have all the tools necessary on their machines (Windows is high on that list) and in many cases inside a VPN like my division we just use WebDAV anyways, completely bypassing the need for SSH Keys in favor of ActiveDirectory.
andrewguenther 14y ago
You got flamed for that comment because you called generating SSH keys "scary crypto stuff." If that scares you, you probably also enjoy the simplicity of storing passwords in plaintext...
- talmand 14y ago
  I found some of the responses to be as troubling as some found the original post. The responders made assumptions and didn't bother asking why he called it "scary crypto stuff". He might have had a point since new people to all this might have reacted that way. But who cares about that right?
- Roritharr 14y ago
  What is your problem with someone being scared of crypto stuff? I find this shows the necessary respect when dealing with security related tasks, since they are HARD. I'm not talking about developing crypto related software, but just setting up a "safe" environment where you can store your SSH Keys in a way that doesn't defeat the purpose of using them in the first place is non-trivial, even for people with degrees. IT Security is a complex field of its own and if a user is afraid of making the wrong choice it only shows that he understands the basics of it.
  - cmelbye 14y ago
    It's one thing to be scared of the deep inner-workings of OpenSSH (which truly can be scary). It's another thing to be "scared" of ssh-keygen, especially considering it's something that most competent developers will use when managing servers, deploying to Heroku, managing source, etc. "ssh-keygen -t rsa", set a passcode on it, upload the id_rsa.pub and you're done. Demonstrating a lack of understanding of that was worrisome for myself and other users that commented on his post a few weeks ago.
    - Roritharr 14y ago
      Nobody said anything about it being scary to type "ssh-keygen -t rsa" but rather about the responsibility that comes with it. I'd bet my right hand the more than 25% of "competent developers" that are "managing servers" will have made security mistakes while storing their ssh keys on a level with storing the password in plaintext on a .txt file on the desktop. Thats whats scary about "crypto stuff", not that it isn't easy to use the tools, its hard to be really sure how to put them to good use when you are no expert on IT security.
GlennS 14y ago
I think it would really help you to have a play with command line Git, just to get a feel for what's going on. SSH keys aren't hard to learn and are useful enough to be worth the time spent. By all means switch to using the GUI after.
- swang 14y ago
  It's not about being unfamiliar with the CLI, it's that Windows isn't like OSX/Linux in that you can just store your keys in a .ssh folder and be done with it (at least not if you don't use cygwin/msys) The method I chose in Windows was to use pageant (part of Putty) to load the keys. Not sure if I missed this option but you can't autoload keys so when you restart pageant you have to readd the keys (which is not terrible bad, just annoying). Haven't tried Github For Windows yet but if it fixes the hassle of using ssh keys then I'll probably use it as my main git client for Windows.
  - X-Cubed 14y ago
    It's not simply a matter of checking an option unfortunately, but you can still get Pageant to load keys at startup by creating a shortcut to it in Programs -> Startup: http://jameschens.com/blog/2010/05/24/starting-pageant-during-startup-with-keys/ http://jameschens.com/blog/2010/05/24/starting-pageant-durin...
  - Schwolop 14y ago
    You can autoload keys with pageant. You have to change the shortcut in your Programs\Startup folder that loads pageant itself. From memory I think it's as simple as adding the paths (in quotes) space separated after the executable. It's certainly in the help documentation at any rate.
  - rbanffy 14y ago
    > Windows isn't like OSX/Linux in that you can just store your keys in a .ssh folder and be done with it (at least not if you don't use cygwin/msys) Then, by all means, use Cygwin or anything that helps you, even if it doesn't come with Windows, if it isn't provided by Microsoft, doesn't look familiar and if it doesn't play well with Visual Studio. If you code for Windows you are coding against an insanely complicated set of APIs.
junto 14y ago
As a Windows user I initially found the setup a little daunting, but the GitHub install guide was a great help and guided me through everything fairly painlessly. If I'm honest about it though, without that help guide, I would have been pretty lost. The ssh setup is a barrier to entry for a great deal of Windows users, simply because they don't have to deal with such things on a daily basis. Whether they all should know these things is debatable. I personally couldn't give shit how 'it' works, as long as I don't have to waste my precious time having to learn something I don't need to. I don't want to have to learn machine code for the same reason. We abstract to become more productive. We build on the shoulders of giants. We don't re-invent the wheel. I could go on... The bottom line is that the previous installation for Windows was manageable, but still it was a drag. Luckily there were enough good resources on the web to help you through it. However, it was time consuming and that barrier has now been removed. In my opinion that's great. It follows Dieter Rams' principles of good design, namely: Good design is as little design as possible. Less, but better – because it concentrates on the essential aspects, and the products are not burdened with non-essentials. http://www.vitsoe.com/en/gb/about/dieterrams/gooddesign http://www.vitsoe.com/en/gb/about/dieterrams/gooddesign Let's remember that Git is a distributed source control mechanism. It needs to move versioned code around. That is its pure purpose. When the security setup takes more effort than the source control you're doing it wrong. That being said, the common language of the Git world will remain the command line. The vast majority of examples you will find on the web when you are learning how to use Git will be executed via the command line. That fact in itself means that you should still learn the basic commands and get familiar with git bash. EDIT: I hope this gives a fairly balanced opinion from a typical Windows Git user. I appreciate that this topic is a heated one.
joelhaasnoot 14y ago
Except that the GUI in Git for Windows doesn't support using SSH keys.
hkolek 14y ago
I really don't want to get involved in this flamewar but I have one question: You can use github with https and you never have to setup ssh and manage keys. So what's the problem? SSH is not the only choice.
MarkJHagan 14y ago
Just ignore the internet warriors below. :). Smile, nod and continue being productive. The GUI saves you time and reduces the learning curve for new developers. If you feel like using the command prompt, you still can. For my team, which consists of designers and developers, this will make the learning curve of my designers a lot easier. Saying that because you don't know how to use SSH keys on a windows machine means you can't write secure code is just silly. It is a slippery slope to say that. If the majority of senior guys actually believed it then we wouldn't have a use for higher level languages (ruby, php, etc), frameworks like .net, etc.

drivebyacct2 14y ago

"Scary crypto stuff"? So you don't understand how PKI works and you're trying to use distributed source control? (I say this not to be a jerk, but because there aren't exactly a wealth of good alternatives given it is a distributed source control mechanism. PKI comes with the territory and an SSH key generation is part of that) GitHub doesn't take any more setup than a standard Git setup takes (well, outside of signing up, a very short process anyhow). Install the Git client via the Windows installer, (point and click, a minute, tops). Generate an SSH key. Upload the id_rsa.pub. Done. I mean, it would be one thing if they left users in the dark about this, but I'm fairly sure that the "Thanks for signing up page" links directly to the OS-specific meticulous step-by-step instructions of generating the key. I'm not sure you understand what it means to be flamed. Every one of the comments is specific about your misconceptions and why signing up for a GitHub account is as trivially easy as signing up for a Twitter account. (Using GitHub as an oAuth account does not require actually uploading a public key)

ctz 14y ago
PKI has nothing to do with SSH keys. Github's use of SSH does not use certificates, and github has no certification infrastructure.
- drivebyacct2 14y ago
  My apologies, I abuse "PKI" to mean "PK infrastructure" (which I know is what the acronym stands for, I'm making a bit of tongue-in-cheek commentary), I think it's silly that PKI implicitly means CAs but according to Wikipedia at least, you're correct.
  - nknight 14y ago
    No, he isn't, and the relevant Wikipedia article is very poorly written. PKI is a highly generic term. Webs of trust are just as much a PKI as a certificate-based system. Everything you've said in this thread has been bang-on, and the replies you're getting are deeply depressing.
    - toddheasley 14y ago
      Can we at least agree that if we attempted a list of all the Xs a programmer needs to know before doing Y and made it law that nobody could write any software at all?
      - rbanffy 14y ago
        Understanding key pairs is very basic knowledge. I don't expect people to understand everything, but things like this, I do. It's dangerous not to.
eli 14y ago
For many people there Github = git, so saying github isn't much harder to set up than Git isn't saying much. Using git on Windows has historically not been super fun. The CLI installer mostly works, but it's pretty clunky. Cygwin works fine too, but it's also not especially elegant. At the very least, known of these solutions conform to the expectations of people of the platform. The GUI clients on Windows last I looked (a year ago) were pretty terrible, especially compared to TortoiseSVN, which isn't bad. OS X, on the other hand, had several very nice GUI clients even before the official Github client came out.
- drivebyacct2 14y ago
  I don't know what difference the "Github = git" distinction makes, from an oAuth perspective it still seems implicitly obvious to me that completing the signup and adding SSH keys are distinct tasks. As for "CLI installer" (I presume you mean the installer for the CLI git client), and Cygwin, I'm not sure what to say. I've used the Git installer dozens of times without problem, there aren't exactly tons of places for it to go wrong. Are there specific or particular issues you have with it? I do indeed forget that some programmers manage to make it far resisting learning to use the command line. Even with step-by-step instructions. I guess at some people I'm willing to fault the developer rather than tools that are powerful that come with good documentation.
  - thmcmahon 14y ago
    Essentially what you're saying is that you understand it; therefore it's simple to understand. Obviously GitHub believe there are people who will benefit from using Git who can't be bothered understanding setting up ssh. Seems reasonable to me.
    - drivebyacct2 14y ago
      I think you're right and I guess that's what I'm beginning to realize. I just kind of assumed that in that case... Git is the wrong tool for their job. If you don't need the "power of Git" (I swear, I'm not in love with Git), then use Dropbox or SVN or something simpler. Seems easier than fighting with keys, and then fighting with git's distributed nature and then fighting with all of the complexities of merging and conflicts. Haha, maybe another of way of putting things from my perspective, I found keys to be the least of my concerns once I got into projects that really used Git and I have a hard time seeing people be successful with Git if the keygen steps throws them off. I hope that explains things from a different perspective :)
andybak 14y ago
I get really sick of this attitude. None of us want to understand every single domain of knowledge from set theory or quantum physics up to cosmology or social psychology. I personally have been forced to learn more low-level Unixy things than I ever wanted to. I want to write simple and elegant front and back end code quickly so I can spend my spare time honing UX and other human-facing aspects of my work. I resent being flamed because I don't fully understand the subtleties of zsh or nginx or or whatever other shiny toy someone else happens to find essential knowledge. Your world might not necessarily be mine.
- wnoise 14y ago
  > None of us want to understand every single domain of knowledge from set theory or quantum physics up to cosmology or social psychology. Speak for yourself. All of those are fascinating.
  - extesy 14y ago
    Speak for yourself. They are fascinating for you, but not for me or many other people.
  - andybak 14y ago
    Actually. I agree with you (apart from the fact that I haven't had a chance to learn much about social psychology). I was just trying to think of examples of disciplines at opposite ends of an imagined continuum.
- drivebyacct2 14y ago
  You can't follow 3 step-by-step instructions, insult me by implying I'm flaming and then drudge up completely unrelated tools in a discussion about ssh-keygen? What do you people want? Seriously? Yes, I'd love to have a big red easy button. It could autoconfigure MySQL, and write init scripts, configure deploy environments because apache conf files are too complicated to learn. Hell, it could even write my backend code and then commit it for me too! I'm done with this ludicrous conversation. I've never seen such an ignorant-excusing entitled discussion in a "technical" community before. Downvote me because you can't follow steps or can't be bothered to learn how to use one of your most important development tools, I've lost interest.
ncarlson 14y ago
> "Scary crypto stuff"? So you don't understand how PKI works and you're trying to use distributed source control? Is this an honest question, or are you alluding to the idea that someone who doesn't understand PKI should not use distributed source control?
- uxp 14y ago
  Well, in the original quote that was cited from "scary crypto stuff" was surrounded with: Last I checked they[GitHub] made you perform a bunch of scary crypto stuff on your local machine before they'd let you in. If performing `ssh-keygen` and entering in an (optional) password from a command line constitutes "scary crypto", then maybe Git and GitHub isn't for everyone. Not that anyone needs to know how PKI works, but they might be better off knowing that `ssh-keygen` generates an ssh key pair, a pretty essential component of the `git` workflow. Maybe that's why SVN is so strong in older development shops. Outside of the effort required to convert an SVN repo to a Git repo, all those developers already have all the tools necessary on their machines (Windows is high on that list) and in many cases inside a VPN like my division we just use WebDAV anyways, completely bypassing the need for SSH Keys in favor of ActiveDirectory.

andrewguenther 14y ago

You got flamed for that comment because you called generating SSH keys "scary crypto stuff." If that scares you, you probably also enjoy the simplicity of storing passwords in plaintext...

talmand 14y ago
I found some of the responses to be as troubling as some found the original post. The responders made assumptions and didn't bother asking why he called it "scary crypto stuff". He might have had a point since new people to all this might have reacted that way. But who cares about that right?
Roritharr 14y ago
What is your problem with someone being scared of crypto stuff? I find this shows the necessary respect when dealing with security related tasks, since they are HARD. I'm not talking about developing crypto related software, but just setting up a "safe" environment where you can store your SSH Keys in a way that doesn't defeat the purpose of using them in the first place is non-trivial, even for people with degrees. IT Security is a complex field of its own and if a user is afraid of making the wrong choice it only shows that he understands the basics of it.
- cmelbye 14y ago
  It's one thing to be scared of the deep inner-workings of OpenSSH (which truly can be scary). It's another thing to be "scared" of ssh-keygen, especially considering it's something that most competent developers will use when managing servers, deploying to Heroku, managing source, etc. "ssh-keygen -t rsa", set a passcode on it, upload the id_rsa.pub and you're done. Demonstrating a lack of understanding of that was worrisome for myself and other users that commented on his post a few weeks ago.
  - Roritharr 14y ago
    Nobody said anything about it being scary to type "ssh-keygen -t rsa" but rather about the responsibility that comes with it. I'd bet my right hand the more than 25% of "competent developers" that are "managing servers" will have made security mistakes while storing their ssh keys on a level with storing the password in plaintext on a .txt file on the desktop. Thats whats scary about "crypto stuff", not that it isn't easy to use the tools, its hard to be really sure how to put them to good use when you are no expert on IT security.

GlennS 14y ago

I think it would really help you to have a play with command line Git, just to get a feel for what's going on. SSH keys aren't hard to learn and are useful enough to be worth the time spent. By all means switch to using the GUI after.

swang 14y ago
It's not about being unfamiliar with the CLI, it's that Windows isn't like OSX/Linux in that you can just store your keys in a .ssh folder and be done with it (at least not if you don't use cygwin/msys) The method I chose in Windows was to use pageant (part of Putty) to load the keys. Not sure if I missed this option but you can't autoload keys so when you restart pageant you have to readd the keys (which is not terrible bad, just annoying). Haven't tried Github For Windows yet but if it fixes the hassle of using ssh keys then I'll probably use it as my main git client for Windows.
- X-Cubed 14y ago
  It's not simply a matter of checking an option unfortunately, but you can still get Pageant to load keys at startup by creating a shortcut to it in Programs -> Startup: http://jameschens.com/blog/2010/05/24/starting-pageant-during-startup-with-keys/ http://jameschens.com/blog/2010/05/24/starting-pageant-durin...
- Schwolop 14y ago
  You can autoload keys with pageant. You have to change the shortcut in your Programs\Startup folder that loads pageant itself. From memory I think it's as simple as adding the paths (in quotes) space separated after the executable. It's certainly in the help documentation at any rate.
- rbanffy 14y ago
  > Windows isn't like OSX/Linux in that you can just store your keys in a .ssh folder and be done with it (at least not if you don't use cygwin/msys) Then, by all means, use Cygwin or anything that helps you, even if it doesn't come with Windows, if it isn't provided by Microsoft, doesn't look familiar and if it doesn't play well with Visual Studio. If you code for Windows you are coding against an insanely complicated set of APIs.

junto 14y ago

As a Windows user I initially found the setup a little daunting, but the GitHub install guide was a great help and guided me through everything fairly painlessly. If I'm honest about it though, without that help guide, I would have been pretty lost. The ssh setup is a barrier to entry for a great deal of Windows users, simply because they don't have to deal with such things on a daily basis. Whether they all should know these things is debatable. I personally couldn't give shit how 'it' works, as long as I don't have to waste my precious time having to learn something I don't need to. I don't want to have to learn machine code for the same reason. We abstract to become more productive. We build on the shoulders of giants. We don't re-invent the wheel. I could go on... The bottom line is that the previous installation for Windows was manageable, but still it was a drag. Luckily there were enough good resources on the web to help you through it. However, it was time consuming and that barrier has now been removed. In my opinion that's great. It follows Dieter Rams' principles of good design, namely: Good design is as little design as possible. Less, but better – because it concentrates on the essential aspects, and the products are not burdened with non-essentials. http://www.vitsoe.com/en/gb/about/dieterrams/gooddesign http://www.vitsoe.com/en/gb/about/dieterrams/gooddesign Let's remember that Git is a distributed source control mechanism. It needs to move versioned code around. That is its pure purpose. When the security setup takes more effort than the source control you're doing it wrong. That being said, the common language of the Git world will remain the command line. The vast majority of examples you will find on the web when you are learning how to use Git will be executed via the command line. That fact in itself means that you should still learn the basic commands and get familiar with git bash. EDIT: I hope this gives a fairly balanced opinion from a typical Windows Git user. I appreciate that this topic is a heated one.

joelhaasnoot 14y ago

Except that the GUI in Git for Windows doesn't support using SSH keys.

hkolek 14y ago

I really don't want to get involved in this flamewar but I have one question: You can use github with https and you never have to setup ssh and manage keys. So what's the problem? SSH is not the only choice.

MarkJHagan 14y ago

Just ignore the internet warriors below. :). Smile, nod and continue being productive. The GUI saves you time and reduces the learning curve for new developers. If you feel like using the command prompt, you still can. For my team, which consists of designers and developers, this will make the learning curve of my designers a lot easier. Saying that because you don't know how to use SSH keys on a windows machine means you can't write secure code is just silly. It is a slippery slope to say that. If the majority of senior guys actually believed it then we wouldn't have a use for higher level languages (ruby, php, etc), frameworks like .net, etc.