Repository: lra/mackup

Issue:
Does Mackup still sync SSH keys by default?
Today I was using Mackup and I noticed this in the help documentation:

> By default, Mackup syncs all application data (including private keys!) via Dropbox, but may be configured to exclude applications or use a different backend with a .mackup.cfg file.

I really like Mackup—it saves a ton of time when setting up a new computer. However, the idea of automatically syncing SSH keys by default really scares me. A few years ago I accidentally exposed an SSH key and someone used it to charge a few thousand dollars to AWS for my company. I'd really like to avoid doing anything like this again in the future.

In reading through #512 and #109, it looks like this behavior was turned off. However, the help documentation doesn't seem to indicate that. So which one is correct? I feel strongly that synching private keys by default is not obvious behavior, and it has the potential to have some serious consequences.

Also, will Mackup sync other types of sensitive information in the future? What scares me most about this is not necessarily what Mackup is syncing today, but what it might add in the future that I don't notice.

Thanks!


Discussion:
No private keys are copied by default, see https://github.com/lra/mackup/blob/master/mackup/applications/ssh.cfg but if you don't specify any application to sync in the config, mackup by default syncs every application config it finds.

Asking for a tool that's supposed to be a oneline line install + launch to require text editing to do the most basic thing is counter productive and defeats its purpose IMO.

You can always use `--verbose` and `--dry-run` to figure out what it plans to do.

I'm open to better solutions, but so far, it's a conflict between users who want nothing done by default and lots of warnings vs others.
Thanks for taking the time to read this issue and the quick response!

> No private keys are copied by default, see https://github.com/lra/mackup/blob/master/mackup/applications/ssh.cfg but if you don't specify any application to sync in the config, mackup by default syncs every application config it finds.

I think my understanding of the default behavior might be a little different. To me, default is what happens when you don't specify any config. I'm on board with the balance of wanting nothing done and wanting everything copied by default.

I think I fall into the camp of wanting everything done by default (as in no configuration file) *except* the operations that could potentially cause security issues. I think it's reasonable to have to opt into those. 

* If the default is to exclude apps with sensitive keys, and somebody doesn't realize their keys aren't synced, then nothing bad happens. They can always add those apps later without any negative consequences.
* If the default is to include apps with sensitive keys, and somebody doesn't realize their keys are synced, then they could be exposing sensitive information by accident. They can remove those apps in the config, but they can't necessarily take back the consequences of exposing SSH keys.
But the ssh config does not sync any key by default: https://github.com/lra/mackup/blob/master/mackup/applications/ssh.cfg

Are you talking about something else?
I think I might be misunderstanding. I was responding to this line of your reply:

> if you don't specify any application to sync in the config, mackup by default syncs every application config it finds.

Does "every application" include SSH? Or are you saying that every application except the excluded ones?
Yes, it includes SSH but only the files referenced in the SS config: https://github.com/lra/mackup/blob/master/mackup/applications/ssh.cfg

No private key is synced.
Okay, I think I understand. So can this line be removed from the help documentation?

> By default, Mackup syncs all application data (including private keys!) via Dropbox, but may be configured to exclude applications or use a different backend with a .mackup.cfg file.

Specifically the "including private keys" part.
Yes, you are right, it's outdated. Want to PR or want me to remove it?
I'm happy to tackle this. It's the least I can do. I'll try to wrap it up this weekend.
please do ;)

Resolving patch:
diff --git a/mackup/main.py b/mackup/main.py
--- a/mackup/main.py
+++ b/mackup/main.py
@@ -27,8 +27,8 @@
     use it on any new system you use.
  4. uninstall: reset everything as it was before using Mackup.
 
-By default, Mackup syncs all application data (including some private keys!)
-via Dropbox, but may be configured to exclude applications or use a different
+By default, Mackup syncs all application data (except for private keys) via
+Dropbox, but may be configured to exclude applications or use a different
 backend with a .mackup.cfg file.
 
 See https://github.com/lra/mackup/tree/master/doc for more information.


Test patch: