We updated our RSA SSH host key
Github had one RSA ssh host key, the most widely supported key format.<p>It was trusted to clone code into the infrastructure of hundreds of thousands of organizations. People pin it everywhere.<p>With this key someone could infect the infrastructure of fintech companies and steal billions of dollars. I know this well because I run a security consulting company focusing mostly on that industry. Mainly this is possible because almost no companies check for git commit signing, and Github does not enforce it anyway, and I digress.<p>This key held enough power over value that some might have used violence to acquire it.<p>With that context of course they chose to place this key in a hardware security module controlled with an m-of-n quorum of engineers to ensure no single human can steal it, expose it, or leak it. Right? ... right?<p>Nope. They admit they just stuck it in a git repo in plain text where any engineer could have copied it to a compromised workstation, or been bribed for it, for who knows how many years. Worse, it was not even some separate employee only intranet git repo, but their own regular public production infra and someone had the power to accidentally make it public.<p>I have no words for this level of gross negligence.<p>Maybe, just maybe, centralizing all trust and security for most of the worlds software development to a proprietary for-profit company with an abysmal security reputation was not the best plan.<p>I will just leave this here: <a href="https:&#x2F;&#x2F;sfconservancy.org&#x2F;blog&#x2F;2022&#x2F;jun&#x2F;30&#x2F;give-up-github-launch&#x2F;" rel="nofollow">https:&#x2F;&#x2F;sfconservancy.org&#x2F;blog&#x2F;2022&#x2F;jun&#x2F;30&#x2F;give-up-github-la...</a>