Hacker News Reader

Comment by mzs | Hacker News Reader

It really wasn't that hard, just created a key pair and added this to my ~/.ssh/config

  Host github.com
   Hostname github.com
   User git
   IdentitiesOnly yes
   IdentityFile ~/.ssh/github-id_rsa

Lots of other ways to do it as well:

https://superuser.com/questions/232373/how-to-tell-git-which...

View on HN

Of course now every pull is authenticated and they can track exactly what users are pulling from what public repositories. Before it used to be that I only really authenticated when I did a git push.

So now when using plain git the choices are to have every action tracked, or to go through a very annoying process involving randomly generated keys.

Not that they couldn't guess that information based on IP address (presuming you're not behind a university NAT or something), but removing password auth does seem like a pretty clear attempt at gathering more user data.

> So now when using plain git the choices are to have every action tracked, or to go through a very annoying process involving randomly generated keys.

EDIT: this alias has a bug that means it doesn't work as intended, see below, don't use it

If you're that worried, I threw this shitty Bash function together in five minutes just now; stick this in your bashrc and then `anongit ...` instead of `git`:

  anongit () {
    mkdir -p ~/.random-ssh-keys
    KEYNAME=$(openssl rand -hex 12)
    KEYFILE=~/.random-ssh-keys/$KEYNAME
    ssh-keygen -q -C $KEYNAME -N "" -f $KEYFILE
    GIT_SSH_COMMAND="ssh -i $KEYFILE" git "$@"
  }

Problem solved!

...or you could clone over HTTPS instead :)

GitHub doesn't just need any SSH key, it needs an SSH key attached to an account, probably for abuse/DoS prevention purposes.

Shit, you're probably right. It only worked because I didn't tell SSH to only use the specified identity files (I threw it together in five minutes without really testing it, you can forgive me). Changing one of the lines to this (which it should have been all along):

    GIT_SSH_COMMAND="ssh -i $KEYFILE -o IdentitiesOnly=yes" git "$@"

...comes up with "Permission denied (publickey)". So, yep, you're 100% right.

Oh well. There's still HTTPS!

Nonsense.

You have been able to clone over https since day 1 of Github and still can:

    git clone https://github.com/user/repository

Reply on news.ycombinator.com