don't git clone over https! (beginner) anthony explains #507

in today's video I talk about git cloning when you want to make a contribution and present the benefits of using an ssh key -- I also show how to set one up

==========

I won't ask for subscriptions / likes / comments in videos but it really helps the channel. If you have any suggestions or things you'd like to see please comment below!

[michalroesler]

That tutorial worked for me. It's awesome and very professional.

[MartinFiala-vwpd]

Short and working. Great stuff! Thanks.

[hamzasayyid]

I'm not really tech savvy, but I don't have to sign in everytime using https. Must have stored the username and password somewhere. Although, these days I use the github cli, so I don't know if that matters

[hemanth]

Thank you! This was very helpful for me.

[OrCarmi]

Thanks for this.
Would you recommend ssh keys over api tokens as well?

[guntbert]

I've been using ssh keys for a Very Long Time™ but never thought of using a naked ssh-add ;-)

[xscorp]

Git also provides using access tokens instead. So if you don't wanna use your password to git, you can use that access token in place of your password. And what is better is that you can confine the access rights for that token. So even if somebody steals your access token, he would only be able to do things that the access token was allowed you do while compromise of SSH keys might lead to havoc.

[mrswats]

Oookay, time to rotate my ssh keys.

Would you recommend storing ssh key pairs in a password manager?

[drz]

Newbie question here about encryption, so since you gave GitHub your public key, does that mean that they can publicly share that repo encrypted with your public key and since you have the private key you're the only one who can decrypt that information?

What about the reverse to push? Is my understanding correct that GitHub would authenticate you when you successfully decrypt the first message sent you encrypted with your public key, hence permitting you to do pushes in the session?

[VijayJaisankar]

Thanks for this video! It not HTTPS, how would we clone a repo into a docker container?

[almostprofessionalrecords]

I used https and it stored my password somewhere, typed it only once months ago and it still works

[Phaust]

Good luck doing that on Windows as a beginner :)

[evadeflow]

I wish I could take your advice—which I agree with—but my corporate overlords have a strict, MITM authenticating HTTP proxy between us employees and the Interwebs, so… cloning via HTTPS is the only option. I’m guessing that’s why GitHub suggests the HTTPS url by default: if you’re able to view the page at all, HTTPS will Just Work™, whereas SSH might not for unlucky folks like me. 🫤