Document the credential proxy #6937
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jeffwidman
commented
Mar 29, 2023
jeffwidman
force-pushed
the
document-credential-proxy
branch
from
9e5972c
to
9a40a37
Compare
jeffwidman
force-pushed
the
document-credential-proxy
branch
3 times, most recently
from
1c5a373
to
2315c72
Compare
jakecoffman
approved these changes
Mar 30, 2023
Add a section to the Readme documenting the credential proxy. This provides three benefits: 1. Users are reassured that GitHub keeps their secrets safe. 2. Security researchers who manage to hack `dependabot-core` aren't surprised when we tell them that doesn't mean they hacked the entire Dependabot Service at GitHub. 3. Clarifies why adding support for private registries to `dependabot-core` isn't enough for those registries to be supported by the Dependabot service that GitHub runs. We still have to plumb those auth schemes into the proxy. Perhaps down the road we may be able to open source the proxy so others can benefit from the increased security, but that's a much larger conversation that we're not quite ready to have.
jeffwidman
force-pushed
the
document-credential-proxy
branch
from
2315c72
to
9e15226
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add a section to the Readme documenting the credential proxy.
rendered
This provides three benefits:
dependabot-corearen't surprised when we tell them that doesn't mean they hacked the entire Dependabot Service at GitHub.dependabot-coreisn't enough for those registries to be supported by the Dependabot service that GitHub runs. We still have to plumb those auth schemes into the proxy.Perhaps down the road we may be able to open source the proxy so others can benefit from the increased security, but that's a much larger conversation that we're not quite ready to have.
For now I tacked this onto the Readme... long term the Readme would probably benefit from getting diced up into shorter docs... but that's out of scope for this PR, and I'd rather land all the content before looking at how to dice it up.