Collaborate Disseminate
My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github.
Some IT departments have github blocked on their firewall. One IT guy suggested to us… Continue reading Using Github’s Public IP Address as Remote URL
Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B.
They work together and they pass their key’… Continue reading Keeping a whitelist of GPG keys on git server
I recently came across a question on stackoverflow.com regarding gitlab.com and ssh config. The solution apparently is to update your ssh config with the following:
Host gitlab.com
UpdateHostKeys no
Unfortunately the author of the top… Continue reading Are there any negative consequences if you change your ssh config for a host with `UpdateHostKeys no`?
On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits.
However, in the scenario that the private key is exposed, the only option GitHub offers is to remove the associated public key. Un… Continue reading What are the best practices pertaining to signing your git commits on GitHub?
Iterative, an open-source startup that is building an enterprise AI platform to help companies operationalize their models, today announced that it has raised a $20 million Series A round led by 468 Capital and Mesosphere co-founder Florian Leibert. Previous investors True Ventures and Afore Capital also participated in this round, which brings the company’s total funding to […] Continue reading Iterative raises $20M for its MLOps platform
Back in January, we covered the news that Ubiquiti had a breach of undisclosed severity. One reader pointed out the compromise of a handful of devices as potentially related. With …read more Continue reading This Week in Security: Ubiquity Update, PHP Backdoor, And Netmask
I’m trying to SSH into my github account. I added my public key to my github account and it showed the fingerprint as something like this
SHA256:aYqWu+zL3hIOWTEGvneI90fehVQt9kuGVN7ov8WlTk8
When I SSH to git, it reject me with
permission d… Continue reading Git SSH public key fingerprint does not match with that on local machine [migrated]
Say I cloned a repo, then maybe worked on it a bit. Then I reverted/pushed all changes, so my friend has all the repo files. Is it safe for me to send him the .git folder? Is there any private information there, such as my username, my ema… Continue reading Is it safe to share .git folder of a public repo?
Google has been working on mitigations for the Spectre attack, and has made available a Proof of Concept that you can run in your browser right now. Spectre is one …read more Continue reading This Week in Security: Spectre in the Browser, Be Careful What you Clone, and Hackintosh
As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files.
I already modified .htaccess to make .git and its content inaccessible.
The attacker … Continue reading Security implications of stolen .git/objects/ files