{"thread":{"id":"62704","subject":"[fingerprint] of github.com","startedAt":"2024-12-28T03:05:22Z","lastAt":"2024-12-28T22:27:26Z","messageCount":5,"participants":["A bughunter","Konstantin Ryabitsev","rsbecker@nexbridge.com"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"509665","messageId":"ROrCxOsQ6KcZqO7YsIr2BGbPsmyUYAHXgF-l3Pwg0-7Z12oBWFrwy4yzgax9Zq6whGT4Fh4gKQxMNlHEoEOBljSvucyX9sQyc3rtT3NT0us=@proton.me","threadId":"62704","inReplyTo":null,"subject":"[fingerprint] of github.com","fromName":"A bughunter","fromEmail":"a_bughunter@proton.me","sentAt":"2024-12-28T03:05:11Z","receivedAt":"2024-12-28T03:05:22Z","isPatch":false,"sender":{"key":"a_bughunter@proton.me","avatar":null},"body":"How would you confirm the correct SSH server fingerprint of github.com upon initial connection? Does GitHub post valid FP anywhere?\n\nfrom A_bughunter@proton.me\n\nSent from Proton Mail Android"},{"id":"509668","messageId":"20241228-stylish-beetle-of-joy-9be836@lemur","threadId":"62704","inReplyTo":"ROrCxOsQ6KcZqO7YsIr2BGbPsmyUYAHXgF-l3Pwg0-7Z12oBWFrwy4yzgax9Zq6whGT4Fh4gKQxMNlHEoEOBljSvucyX9sQyc3rtT3NT0us=@proton.me","subject":"Re: [fingerprint] of github.com","fromName":"Konstantin Ryabitsev","fromEmail":"konstantin@linuxfoundation.org","sentAt":"2024-12-28T08:07:45Z","receivedAt":"2024-12-28T08:07:50Z","isPatch":false,"sender":{"key":"konstantin@linuxfoundation.org","avatar":"https://gravatar.com/avatar/7cb8827c6de56e1bd2dea16508c6708aa43feed3bf3813bcdacecdf96ceadd79?d=mp&s=160"},"body":"On Sat, Dec 28, 2024 at 03:05:11AM +0000, A bughunter wrote:\n> How would you confirm the correct SSH server fingerprint of github.com upon initial connection? Does GitHub post valid FP anywhere?\n\nPlease do a modicum of effort before posting to the list. This is literally\nthe first hit on the search engines:\nhttps://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints\n\nAdditionally, Github specific questions are not really on topic for this list,\nunless they have to do with git specifically.\n\n-K (with moderator's hat on)\n"},{"id":"509680","messageId":"025b01db592d$29cd4380$7d67ca80$@nexbridge.com","threadId":"62704","inReplyTo":"ROrCxOsQ6KcZqO7YsIr2BGbPsmyUYAHXgF-l3Pwg0-7Z12oBWFrwy4yzgax9Zq6whGT4Fh4gKQxMNlHEoEOBljSvucyX9sQyc3rtT3NT0us=@proton.me","subject":"RE: [fingerprint] of github.com","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2024-12-28T13:33:58Z","receivedAt":"2024-12-28T13:34:13Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On December 27, 2024 10:05 PM, A bughunter wrote:\n>How would you confirm the correct SSH server fingerprint of github.com upon\n>initial connection? Does GitHub post valid FP anywhere?\n\nThis is not the correct list for this question. Contact GitHub support, please.\n\n"},{"id":"509702","messageId":"Ai7oUOle2gNhbxgAMTtbayo6Quf4YRgJbFIYYSqUHdgNoJL89fv7P7gYIHNnmlzLn77z0n3KI6HI09_VUmsku4qZ1wmudP0eEb9GN89PmMo=@proton.me","threadId":"62704","inReplyTo":"20241228-stylish-beetle-of-joy-9be836@lemur","subject":"Re: [fingerprint] of github.com","fromName":"A bughunter","fromEmail":"a_bughunter@proton.me","sentAt":"2024-12-28T21:12:14Z","receivedAt":"2024-12-28T21:12:20Z","isPatch":false,"sender":{"key":"a_bughunter@proton.me","avatar":null},"body":"My reply and answer here.\n\nfrom A_bughunter@proton.me\n\nSent from Proton Mail Android\n\n\n-------- Original Message --------\nOn 12/28/24 2:07 AM, Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:\n\n>  On Sat, Dec 28, 2024 at 03:05:11AM +0000, A bughunter wrote:\n>  > How would you confirm the correct SSH server fingerprint of github.com upon initial connection? Does GitHub post valid FP anywhere?\n>  \n>  Please do a modicum of effort before posting to the list. This is literally\n>  the first hit on the search engines:\n>  https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints\n>  \n\nYeah, but you should post the keys in the community incase an attacker would intercept, block, or change those posted in the official location. That is the great benifit of community support. These are GitHub's public key fingerprints:\n\nSHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s (RSA)\nSHA256:br9IjFspm1vxR3iA35FWE+4VTyz1hYVLIE2t1/CeyWQ (DSA - closing down)\nSHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM (ECDSA)\nSHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU (Ed25519)\nYou can add the following ssh key entries to your ~/.ssh/known_hosts file to avoid manually verifying GitHub hosts:\n\ngithub.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl\ngithub.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=\ngithub.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=\n\n\n\n\n\n\n"},{"id":"509704","messageId":"20241228-naughty-satisfied-binturong-32b43b@lemur","threadId":"62704","inReplyTo":"Ai7oUOle2gNhbxgAMTtbayo6Quf4YRgJbFIYYSqUHdgNoJL89fv7P7gYIHNnmlzLn77z0n3KI6HI09_VUmsku4qZ1wmudP0eEb9GN89PmMo=@proton.me","subject":"Re: [fingerprint] of github.com","fromName":"Konstantin Ryabitsev","fromEmail":"konstantin@linuxfoundation.org","sentAt":"2024-12-28T22:27:22Z","receivedAt":"2024-12-28T22:27:26Z","isPatch":false,"sender":{"key":"konstantin@linuxfoundation.org","avatar":"https://gravatar.com/avatar/7cb8827c6de56e1bd2dea16508c6708aa43feed3bf3813bcdacecdf96ceadd79?d=mp&s=160"},"body":"On Sat, Dec 28, 2024 at 09:12:14PM +0000, A bughunter wrote:\n> >  Please do a modicum of effort before posting to the list. This is literally\n> >  the first hit on the search engines:\n> >  https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints\n> >  \n> \n> Yeah, but you should post the keys in the community incase an attacker would\n> intercept, block, or change those posted in the official location.\n\nYou have to keep two things in mind:\n\n1. This mailing list has no relationship with GitHub.com. This list is about\n   the software, not the hosting service that uses it.\n\n2. The attacker (e.g. me) can also modify the archives of this mailing list to\n   put whatever they want there, so you should absolutely not use the archives\n   as a source of any kind of truth. :)\n\n-K\n"}]}