[Slackbuilds-users] Private SSH key in the slackbuilds repository

2013-01-29 Thread Heinz Wiesinger
As some of you might have heard or read already in the news,
there was an issue on GitHub where ssh private keys published
in public repos were exposed and searchable (More here:
http://www.securityweek.com/github-search-makes-easy-discovery-encryption-
keys-passwords-source-code )

As a consequence GitHub is now sending out notifications to all
affected users. If you have the slackbuilds repository mirrored
on GitHub it might be that you'll get such a notification as well.
The file in question is network/freenx/config/nomachine.id_dsa.key.

This key is the default key shipped with all NX clients, it's up
to the admin to decide to use a different one. But even if you
use the default key it's only used for the initial handshake, you
still need a valid user account after.

As such you can safely ignore the notification from GitHub. There
comes no harm from having this key publicly in our repo.

Grs,
Heinz


signature.asc
Description: This is a digitally signed message part.
___
SlackBuilds-users mailing list
SlackBuilds-users@slackbuilds.org
http://lists.slackbuilds.org/mailman/listinfo/slackbuilds-users
Archives - http://lists.slackbuilds.org/pipermail/slackbuilds-users/
FAQ - http://slackbuilds.org/faq/



Re: [Slackbuilds-users] Private SSH key in the slackbuilds repository

2013-01-29 Thread Willy Sudiarto Raharjo
 As a consequence GitHub is now sending out notifications to all
 affected users. If you have the slackbuilds repository mirrored
 on GitHub it might be that you'll get such a notification as well.
 The file in question is network/freenx/config/nomachine.id_dsa.key.

 This key is the default key shipped with all NX clients, it's up
 to the admin to decide to use a different one. But even if you
 use the default key it's only used for the initial handshake, you
 still need a valid user account after.

 As such you can safely ignore the notification from GitHub. There
 comes no harm from having this key publicly in our repo.

Ah... i just got that one too yesterday :)

-- 
Willy Sudiarto Raharjo
Personal Blog : http://willysr.blogspot.com
Linux Blog: http://slackblogs.blogspot.com
___
SlackBuilds-users mailing list
SlackBuilds-users@slackbuilds.org
http://lists.slackbuilds.org/mailman/listinfo/slackbuilds-users
Archives - http://lists.slackbuilds.org/pipermail/slackbuilds-users/
FAQ - http://slackbuilds.org/faq/