Hacker News Reader

Comment by beberlei | Hacker News Reader

god beware if your open source project needs a single private repository to share passwords between admins for example or private config for your webserver. Suddenly you see yourself at 394$ compared to the 7$ you paid before.

View on HN

> beware if your open source project needs a single private repository to share passwords

Passwords emphatically do not belong in git.

Your private repos should be maintained such that accessing them would not compromise your security.

if you share Ansible inventory files that are encrypted with ansible-vault, then this is not happening. But i still wouldn't want to have a public repository with the files and the metadata of servers that is clearly not meant for public consumption.

Let me brig another example for OSS projects that could need a private repository: branches for security fixes that are not public yet.

> "branches for security fixes that are not public yet"

A private git server would probably be better for that, but also wouldn't cost $0.

> a single private repository to share passwords between admins

Please tell me you're kidding.

I hope that any team using github to share passwords is driven to move away from that method because of this price change. That's a bad bad idea.

Why? If it is Encrypted in ansible vault or something it's not a terrible way to keep your creds.

I think that wasn't clear initially. But granted, valid point.

If they're encrypted, you can put them in a public repo.

Call it overkill, but I would see no reason not to go both private repo + encrypted creds.

Is ansible vault encryption brute force proof? I have no idea. I could spend an hour and figure out. But why not just follow decent engineering principles and double lock my door?

What's wrong with using Dropbox or something like that?

Reply on news.ycombinator.com