docs: change git clone to https:// link

[ethanmuller]

I ran into a little snag while setting up a new laptop (running Mojave).

Using git clone [email protected]:sparkbox/laptop.git didn't work for a fresh install. The https:// link did.

[yock]

@ethanmuller Would it make sense to have adding your public key to Github as a prerequisite to running the laptop script rather than using HTTPS?

[ethanmuller]

@yock What's the benefit of using a [email protected]: link over HTTPS?

As long as it's nothing major, I think it'd make sense to include instructions for that after this point in the readme.

I like the idea of putting that somewhere though! Setting that up is really relevant to this process, and I wasn't looking forward to digging around to find it.

[yock]

@ethanmuller SSH is the preferred way to authenticate with Github anyway and it would help us ensure from the get-go that it's working correctly.

[ethanmuller]

@yock What benefits does SSH provide over HTTPS for somebody trying to run this script?

I'm picturing a new hire* with a fresh laptop trying to run this script. Maybe they haven't gone through the process of setting up public keys yet. I think it'd streamline things for them if we switch this to HTTPS, to eliminate the possibility of them getting hung up on SSH stuff.

---

* or me trying to run this script last night, having a bad time 😉

[yock]

@ethanmuller I think the main benefit here is that we ensure, from the start, that we are preferring SSH over HTTPS. If this seems reasonable I'm happy to take on making this easier by improving the docs, the laptop script, or both.

[ethanmuller]

@yock Yeah... I guess don't feel too strongly on exactly how we improve the documentation. I mostly care that it gets improved in the first place, since it failed for me.

I still don't quite understand why we prefer SSH over HTTPS. GitHub recommends using HTTPS. Is SSH more secure somehow?

[yock]

Github recommends HTTPS for portability concerns. They don’t have to ask what platform you’re using if they just say “use HTTPS.” PKI is more secure than username and password authentication. This Security StackExchange thread is a good summary. Parts of it are irrelevant from our point of view (as long as you’re using 1Password) but much of it is universally applicable.

https://security.stackexchange.com/questions/3605/certificate-based-authentication-vs-username-and-password-authentication

My opinion is one of many on this team and not authoritative. If others similarly believe that HTTPS vs SSH isn’t a big deal then that’s fine.

[ethanmuller]

@yock If we could find a way to clearly explain this process to the people running this script, I'd be into the idea of putting that first!

My main motivation with this PR was to make running the script a little easier.