Collaborate Disseminate
OpenSSH has minted their 9.0 release, and it includes a pair of security changes. Unlike most of the releases we cover here, this one has security hardening to prevent issues, …read more Continue reading This Week in Security: OpenSSH, Git, and Sort-of NGINX 0-day
Consider this scenario:
You have a central Git repository online (e.g. on Github, GitLab, etc.)
User1 and User2 have access to that repository
User1 is malicious and changes some files in a past commit (he does not add a new, normal commi… Continue reading Can you alter a Git repository without anyone noticing it?
A newly joined software engineer in our organization uploaded one of company’s proprietary git repository on his personal Github public account, likely without nefarious intent.
How do I ensure this won’t happen again in future? Apart from… Continue reading Employee uploaded proprietary private repository on his github public account
Sometimes there’s no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check against some hash to prevent tampering… Continue reading Can I trust a hash commit for integrity of the entire repository?
If you are new to Git, understanding how Git commands… Continue reading How to Check out a Remote Git Branch
which rules I should choose for ssh algo selection, provided it will be used near 100% for git operations? I’m going to use it with git on linux laptops, often used on public wifi.
currently I have:
speed
modern (no need to serve old SSH … Continue reading which principles for ssh key algo selection I should use for git-mainly operations?
I just had a warning from Vivaldi 5 that Vivaldi’s profile might have been under a git repo, which could be a security risk exposing passwords and the like and that they had added a .gitignore to mitigate the risk.
• [Privacy] Add .gitign… Continue reading Risks / best practices in putting your `~`/user home under git to track configuration files only in that directory, not subdirectories?
Linus mentioned in 2009 that "Signing each commit is totally stupid".
Has the common view evolved on this subject since then ? Doesn’t it protect against someone usurping your identity to commit something into your git repo ?
Tha… Continue reading Git Signing commits in a private repo
Recently, GitLab[1] and GitKraken[2] notified users about a vulnerability in GitKraken version v in range 7.6.0<=v<=8.0.0. Those versions are affected by CVE-2021-41117[3] and therefore, generate weak SSH keys. Now, as an administrat… Continue reading How to detect weak SSH keys affected by CVE-2021-41117
I’m working on a cloud synced feature for my notes based on this article
I try to share my git-crypt-key between my devices (my PC and my laptop) in order to decrypt my remote GitHub repo where my notes are stored.
For this, I’m trying usi… Continue reading Share file between different local machine using scp cmd