5 ms·
No thanks. The last thing I want is my version control host getting opinionated about my application domain.
by jcoder 14y ago
No thanks. The last thing I want is my version control host getting opinionated about my application domain.
- beering 14y agoWhat if they just gave you a onetime warning instead?
- 1qaz2wsx3edc 14y agoI like this game: What if that annoyed the pants off some people?
- drivebyacct2 14y agoYou're kidding right?
- georgemcbay 14y agoThen they should surely add it. People so easily annoyed by trivial (yet potentially helpful) things should be annoyed as much as possible by the rest of us.
- ramblerman 14y agoI think beering was following the old adage: you can annoy some of the people all the time, or you can annoy all the people some of the time. You can't however annoy all the people all the time.
- cllns 14y agoCare to elaborate on why? Github's tagline is currently "Build software better, together." Wouldn't this help people create better software? I'm not saying they should automatically add secret_token.rb to gitignore, just that they could let you know you might not want to do that.
- Ryoku 14y agoI don't think the answer is having GitHub do anything about it. The word has to be spread, yes. But not that way. Developers need to know about the importance of all their files and their security at development, else just think of what will happen when GitHub is not around or when they use another form of Git, etc. Problems need to be solved from the root and that means teaching developers to be more security aware, not making tools that will make said awareness easier to forget.
- dephex 14y agoBut wouldn't this be teaching developers? They upload the file and Github explains to them that it should be kept secret, and the developer has the opportunity to revoke the file. That sounds like the ultimate way of 'spreading the word', and if Github does disappear, they will have made people more aware. Not to mention it won't affect people who have been doing this all along.
- omra 14y agoOut of the 3000 repositories which I estimate to be affected by this issue (using Google and eliminating some common techniques used to circumvent the problem), I estimate 1600 of them are not on Github. Even if Github does its best to remove the issue completely, I don't believe it will have a huge impact. I believe that a better idea is to fix this in Rails. Why is a secret key loaded from the configuration directory? I agree with ajross's comment (http://news.ycombinator.com/item?id=4970347 http://news.ycombinator.com/item?id=4970347). This isn't to say that Github should do nothing to control the problem, but more must be done than just that.
- pavel_lishin 14y agoWarning half of the project owners/maintainers that this is a problem won't have a huge impact?
- Ryoku 14y agoWell yes, it could be teaching developers. But you would be teaching a single solution for a single problem. I think it would be better to entice solutions that target the bigger issue on security awareness. All this new tools that make it so much easier to develop complex applications have huge benefits, but I believe they are also pushing new developers away from understanding the concepts behind what they are doing. As someone who started as a designer and grew on my own into development, I've seen this issue first hand.