What are the security implications for sharing ansible playbooks/roles (or any infrastructure as code) via Github, blog, or similar? On the one hand sharing helps people learn, but on the other it provides information for potentially critical systems that an attacker could exploit.
On github many people seem to share the roles they are using but the playbooks less often. I also realize there are things like ansible-vault for encryption, but up to a point it seems easier to just not share them publicly. I'm personally now just using gitolite to "privately" host my own ansible playbooks and roles. Do you have any rules of thumb for what you do or do not share?
For context, I thought of this question after listening to a Darknet Diaries podcast about the LinkedIn hack from 2012 where the attacker gained access by first breaching the home network of an employee via a blog hosted on their LAN.
Love the show. Thank you for all you do.
Nate