{"action":"created","issue":{"url":"https://api.github.com/repos/circleci/circleci-docs/issues/318","repository_url":"https://api.github.com/repos/circleci/circleci-docs","labels_url":"https://api.github.com/repos/circleci/circleci-docs/issues/318/labels{/name}","comments_url":"https://api.github.com/repos/circleci/circleci-docs/issues/318/comments","events_url":"https://api.github.com/repos/circleci/circleci-docs/issues/318/events","html_url":"https://github.com/circleci/circleci-docs/issues/318","id":174975842,"number":318,"title":"RE: jekyll/_docs/github-security-ssh-keys.md","user":{"login":"jasonm23","id":71587,"avatar_url":"https://avatars.githubusercontent.com/u/71587?v=3","gravatar_id":"","url":"https://api.github.com/users/jasonm23","html_url":"https://github.com/jasonm23","followers_url":"https://api.github.com/users/jasonm23/followers","following_url":"https://api.github.com/users/jasonm23/following{/other_user}","gists_url":"https://api.github.com/users/jasonm23/gists{/gist_id}","starred_url":"https://api.github.com/users/jasonm23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jasonm23/subscriptions","organizations_url":"https://api.github.com/users/jasonm23/orgs","repos_url":"https://api.github.com/users/jasonm23/repos","events_url":"https://api.github.com/users/jasonm23/events{/privacy}","received_events_url":"https://api.github.com/users/jasonm23/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-04T23:38:12Z","updated_at":"2016-09-07T15:54:58Z","closed_at":null,"body":"Hello, \r\n\r\nI'm not sure recommending providing a \"github machine user\" is wise / good / necessary.\r\n\r\nIf specific access (e.g. to a git submodule authenticated differently) is required it can be provided by additional deploy keys.\r\n\r\nAlso if ci/automated write to a repo is required, deploy keys can also be write enabled."},"comment":{"url":"https://api.github.com/repos/circleci/circleci-docs/issues/comments/245327553","html_url":"https://github.com/circleci/circleci-docs/issues/318#issuecomment-245327553","issue_url":"https://api.github.com/repos/circleci/circleci-docs/issues/318","id":245327553,"user":{"login":"felicianotech","id":6017470,"avatar_url":"https://avatars.githubusercontent.com/u/6017470?v=3","gravatar_id":"","url":"https://api.github.com/users/felicianotech","html_url":"https://github.com/felicianotech","followers_url":"https://api.github.com/users/felicianotech/followers","following_url":"https://api.github.com/users/felicianotech/following{/other_user}","gists_url":"https://api.github.com/users/felicianotech/gists{/gist_id}","starred_url":"https://api.github.com/users/felicianotech/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/felicianotech/subscriptions","organizations_url":"https://api.github.com/users/felicianotech/orgs","repos_url":"https://api.github.com/users/felicianotech/repos","events_url":"https://api.github.com/users/felicianotech/events{/privacy}","received_events_url":"https://api.github.com/users/felicianotech/received_events","type":"User","site_admin":false},"created_at":"2016-09-07T15:54:58Z","updated_at":"2016-09-07T15:54:58Z","body":"Hi,\r\n\r\nThis is referring to a system user on a machine, such as a user on an Ubuntu box. If you don't use a dedicated GitHub/CircleCI user, what happens is you're then giving access to everything on the machine that the user would have access to. For example, if I use an SSH deploy key with CircleCI to a server that I log into using my own username, the host might be `felicianotech@mysever.com`. If I had passwordless `sudo` access on that server and somehow my SSH key on CircleCI gets compromised, lost, leaked, etc, someone can use it to do whatever they want on my server.\r\n\r\nThis isn't referring to access to repos on GitHub.com itself."}}
{"actor":{"display_login":"felicianotech"}}