1

I'm sorry if I don't ask this on the right site, but there isn't any site related to Git.

I want to store my personal data on GitLab *(even if GitLab is essentially for sharing source code)* to serve as backup and to sync it between my computers, and prevent data loss.

I want to know if this is really secure and I can trust GitLab and send all my data to it.

Improve this question

3 Answers 3

Reset to default
3

GitLab is not meant to be used as a backup.

I don't know if they store your data encrypted, so for better security you should encrypt your data (maybe with gpg or something like duplicity) before uploading.

Improve this answer
3
  • So if I use it for my dotfiles and only for my dotfiles, security doesn't matters?
    – Minteck
    Jul 19, 2019 at 18:03
  • That's entirely your decision.
    – Daniel
    Jul 19, 2019 at 18:08
  • I just need to make sure that the .gitcredentials and .gitconfig files aren't uploaded and this should be right...
    – Minteck
    Jul 19, 2019 at 18:09
3

can I trust GitLab?

Short answer: No. Trusting Gitlab is one thing, but trusting all the employees of Gitlab having root access to the servers is very different.

Real answer: Nobody knows.

For a sad story, read: GitLab account hacked and repo wiped, then ask yourself if you wish to be in the same position as that poster.

When your files are in the cloud, you are basically exposed to an attack by all the hackers in the world. I wouldn't call that secure.

Improve this answer
5
  • The case you've referenced wasn't GitLab's fault, it was actually caused by repo owners' misuse of git. There's a lesson to be learnt, though: OP, pick the right tool for the job. Don't repurpose git for this, use a tool that was built for secure data backup. Not a VCS.
    – gronostaj
    Jul 19, 2019 at 17:53
  • That's the fault of a weak password.
    – Minteck
    Jul 19, 2019 at 18:06
  • 1
    How weak is weak? What unknown hacks exist for stealing passwords? If you don't know the answer, don't assume that you know everything required to make your repository safe. See also GitHub, Bitbucket and GitLab open-source projects hacked and held for ransom, where there are theories but nobody clearly knows how the hacker did it.
    – harrymc
    Jul 19, 2019 at 18:14
  • @Minteck - You don't actually know it was due to a weak password. A brute force attack can be successful if there isn't an account lockout after X number of attempts. Attempting to access an account, using hundreds of thousands of combinations a day is literally nothing to a computer.
    – Ramhound
    Jul 19, 2019 at 19:15
  • 1
    @Minteck The problem was that people were accidentally serving .git with their apps and they had repo added as a HTTPS remote in .git/config with plaintext login+password. It's literally explained in the second paragraph of the linked answer.
    – gronostaj
    Jul 20, 2019 at 18:33
0

Gitlab isn't really intended for this, but for a suggested alternative, you might want to look at Hashicorp Vault, or you can encrypt data with Ansible Vault and upload it to private repository. That could be a private github repo, or on a self hosted gitlab instance as well.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.