4 ms·
Completely agree, GitHub private repos are a huge target. Even if you use 2FA, after login it's just a cookie that separates the good from the bad. How could GH
by eik3_de 13y ago
Completely agree, GitHub private repos are a huge target. Even if you use 2FA, after login it's just a cookie that separates the good from the bad. How could GH improve that? Client-side SSL Certs?
- chimeracoder 13y agoIf you're talking about for company projects, the enterprise version of Github is self-hosted (e.g. on a VPN): https://enterprise.github.com/ https://enterprise.github.com/
- ProAm 13y agoPeople shouldn't trust the cloud for important source storage. Always self-host anything you want to keep private.
- VBprogrammer 13y agoI'm pretty sure many more codebases have been lost through failures to secure internal networks by corporate IT departments than through vulnerabilities in cloud hosting providers.
- ProAm 13y agoI agree. I was speaking more about security than we blew up our own code repository. Everyone has the ability to light their own house on fire.
- Fogest 13y agoI think he is referring to many people failing to secure their networks and having code stolen. It can be just as insecure, if not worse than a cloud provider if done wrong.
- deleted 13y ago[deleted]
- count 13y ago'People' shouldn't 'trust' anything. Verify. Important storage can be done 'in the cloud', but you need to audit and verify the cloud vendor is providing the proper controls. Just like you need to do 'privately'.
- cenhyperion 13y agoFor code projects that are between me and a couple of other devs, none of whom are infrastructure security experts, I trust a company like Github a lot more than one of us trying to hack something together on a server.
- jethro_tell 13y agoWith the exception that if you have three guys hacking something together a dedicated server or a box off your cable modem, with git tunneled over ssh using keys and a proper firewall, you'd probably be miles ahead. That might take you an afternoon to set up with almost no experience. Not to say that it couldn't be compromised, but your not a target like github might be. If you're working with an enterprise level project with more complex auth and access methods, more users, performance and scaling needs, you'd need a real security implementation.
- ersii 13y agoThere's plenty of companies/enterprises that use regular Github private repositories though.