3 ms·
Heroku doesn't require a public GitHub account. Seems like the best lesson learned is keep personal work personal, use private repos if using GitHub.
by matchagaucho 12y ago
Heroku doesn't require a public GitHub account.
Seems like the best lesson learned is keep personal work personal, use private repos if using GitHub.
- snuxoll 12y agoOr, if you don't want to pay for the privilege of not having your work public, go use Bitbucket.
- cheald 12y agoHeroku doesn't require any Github account - that's the beauty of git :) That said, I'd still argue that you should practice defense-in-depth; plan for "this is how I'll limit damage when someone gets ahold of these credentials" rather than "Nobody will get these, so I can do dangerous things with them". It's the same argument behind "don't do things as root unless you have no other choice"; trading security for convenience works really nicely right up to the point where you get your teeth kicked in.
- encoderer 12y ago*use bitbucket
- serge2k 12y agoNo, the lesson is don't commit credentials and if they leak then revoke them immediately. and use least privilege to make sure that if you do screw up it's as minor as possible.
- numbsafari 12y ago+1 - Even if you are using a private repo within your company, committing credentials is foolishness. It's trivial for someone to intentionally or unintentionally leak them, or abuse them. And personally, I've found that it's just good practice to exercise those kinds of precautions for "throw-away" projects regardless of their "throw-away" status. It keeps you honest.