Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If there's a managed server you don't trust, it's unsafe to put anything that authenticates you to GitHub there, because it can (e.g.) modify the git command to push malicious code.

For a semi-trusted machine (e.g., you want to "git push" to work-related OSS from your work desktop, but you don't want your work HR/IT departments to have full access to your GitHub account if they decide they want it), make a new SSH key and configure it as a read/write deploy key for that one repo. This workflow is primarily intended for automation, but it's reasonable for this sort of interactive use as well.

https://docs.github.com/en/developers/overview/managing-depl...



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: