Add GitHub DNS info about laptop HOT 3 CLOSED

Pinging @commit-dkp. I'm curious about any potential security risks associated with putting Github's IP addresses in ~/.ssh/config and the hostfile. Seems like it should be safe, so long as Github doesn't go and change all its addresses all of a sudden?

from laptop.

The way I read your question is essentially, what risk is there that someone might try to spoof GitHub to an 18F engineer. As long as clients are using pubkey authentication, the credentials cannot be replayed, but it is also incumbent on the engineer to not disregard warnings if the presented host key for github.com doesn't match the known host key for github.com.

At a higher-level, IP addresses and DNS hostnames are not credentials, and so trust decisions generally ought not to be based on them. Instead, cryptographic secrets like those employed at the SSH transport level are what enable clients and servers to trust each other.

It seems then that the only risk is if you were to hard-code GitHub's IP addresses somewhere, eventually those addresses will change, and all of the engineers who used the laptop script will be unable to reach GitHub until they update or remove those IP addresses. To me, this seems to be trading one temporary problem (DNS unavailability) with one permanent problem (hard-coded IP addresses).

from laptop.

trading one temporary problem with one permanent problem

This is a very useful framing. Then it makes sense to me not to hard-code the IP addresses, because anyone who uses the laptop script will likely have a heck of a time figuring out why they suddenly can't connect if/when Github's IP addresses change. It seems unlikely that people will know the script added that, or even if they once did, that they will remember.

Instead, maybe this information can go in engineering guides/docs as a note about temporarily working with Github through DNS outages.

from laptop.