{"thread":{"id":"14848","subject":"do without .netrc","startedAt":"2008-08-05T23:00:54Z","lastAt":"2008-08-08T15:36:16Z","messageCount":6,"participants":["Jürgen Mangler","Miklos Vajna","Michael J Gruber"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"86300","messageId":"4898DBA6.1060707@univie.ac.at","threadId":"14848","inReplyTo":null,"subject":"do without .netrc","fromName":"Jürgen Mangler","fromEmail":"juergen.mangler@univie.ac.at","sentAt":"2008-08-05T23:00:54Z","receivedAt":"2008-08-05T23:00:54Z","isPatch":false,"sender":{"key":"juergen.mangler@univie.ac.at","avatar":null},"body":"\"git clone http://a:b@donatello.pri.univie.ac.at/repositories/0/Data/\" \nis not working\n\nalso \"git clone \nhttp://a@donatello.pri.univie.ac.at/repositories/0/Data/\" is not asking \nfor password. is it supposed to?\n\nit is working without a:b@ part, but ~/.netrc instead\n\n:-(, is it possible without .netrc\n\ngit version 1.5.4.3\n\nthanks, regards\n\nJürgen\n"},{"id":"86325","messageId":"20080806085025.GU32057@genesis.frugalware.org","threadId":"14848","inReplyTo":"4898DBA6.1060707@univie.ac.at","subject":"Re: do without .netrc","fromName":"Miklos Vajna","fromEmail":"vmiklos@frugalware.org","sentAt":"2008-08-06T08:50:25Z","receivedAt":"2008-08-06T08:50:25Z","isPatch":false,"sender":{"key":"vmiklos@frugalware.org","avatar":"https://gravatar.com/avatar/401c1cbbb3a5d13e650c691a2c71d6fd0b80df1a01bc74d9f1972675dd58f2bd?d=mp&s=160"},"body":"On Wed, Aug 06, 2008 at 01:00:54AM +0200, Jürgen Mangler wrote:\n> it is working without a:b@ part, but ~/.netrc instead\n> \n> :-(, is it possible without .netrc\n\nI thought questions have question marks. ;-)\n\nAnyway, what is the advantage of not using a ~/.netrc?\n"},{"id":"86326","messageId":"g7bq85$otb$1@ger.gmane.org","threadId":"14848","inReplyTo":"20080806085025.GU32057@genesis.frugalware.org","subject":"Re: do without .netrc","fromName":"Michael J Gruber","fromEmail":"michaeljgruber+gmane@fastmail.fm","sentAt":"2008-08-06T09:17:48Z","receivedAt":"2008-08-06T09:17:48Z","isPatch":false,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"Miklos Vajna venit, vidit, dixit 06.08.2008 10:50:\n> On Wed, Aug 06, 2008 at 01:00:54AM +0200, Jürgen Mangler wrote:\n>> it is working without a:b@ part, but ~/.netrc instead\n>>\n>> :-(, is it possible without .netrc\n> \n> I thought questions have question marks. ;-)\n> \n> Anyway, what is the advantage of not using a ~/.netrc?\n\nNot having the password on disk[?!]\n\nMichael\n"},{"id":"86333","messageId":"20080806105022.GX32057@genesis.frugalware.org","threadId":"14848","inReplyTo":"g7bq85$otb$1@ger.gmane.org","subject":"Re: do without .netrc","fromName":"Miklos Vajna","fromEmail":"vmiklos@frugalware.org","sentAt":"2008-08-06T10:50:22Z","receivedAt":"2008-08-06T10:50:22Z","isPatch":false,"sender":{"key":"vmiklos@frugalware.org","avatar":"https://gravatar.com/avatar/401c1cbbb3a5d13e650c691a2c71d6fd0b80df1a01bc74d9f1972675dd58f2bd?d=mp&s=160"},"body":"On Wed, Aug 06, 2008 at 11:17:48AM +0200, Michael J Gruber wrote:\n> Not having the password on disk[?!]\n\nI think you can't avoid so (we are talking about http).\n\nThere is no such thing as ssh-agent for http, and typing the password\nfor each pull or push is boring. (OK, this is subjective, but I think\nnobody types his/her pass on every push/pull.)\n\nYou could have the password in the URL, but the it's in .git/config,\neven worse.\n"},{"id":"86337","messageId":"48998AC7.20204@univie.ac.at","threadId":"14848","inReplyTo":"20080806085025.GU32057@genesis.frugalware.org","subject":"Re: do without .netrc","fromName":"Jürgen Mangler","fromEmail":"juergen.mangler@univie.ac.at","sentAt":"2008-08-06T11:28:07Z","receivedAt":"2008-08-06T11:28:07Z","isPatch":false,"sender":{"key":"juergen.mangler@univie.ac.at","avatar":null},"body":"Miklos Vajna wrote:\n> On Wed, Aug 06, 2008 at 01:00:54AM +0200, Jürgen Mangler wrote:\n>> it is working without a:b@ part, but ~/.netrc instead\n>>\n>> :-(, is it possible without .netrc\n> \n> I thought questions have question marks. ;-)\n\nExplanation 1: I wrote it to IRC and then thought maybe crossposting to \nthe list would be no bad idea. On IRC i was not using question marks, \nmail was just copying the lines, forgot to add question marks.\n\nExplanation 2: its not questions but accusations! *fg*\n\n> Anyway, what is the advantage of not using a ~/.netrc?\n\nIt's mentioned on several occations that it is not necessary (e.g. \nhttp://www.kernel.org/pub/software/scm/git/docs/howto/setup-git-server-over-http.txt)\n\nThe advantages for me would be:\n\na) I have multiple different passwords on the same server for different \ndirectories, it's not possible to put this to a netrc (AS FAR AS I \nKNOW). So i have to edit the netrc for every push, clone, ... -> very \ninconvenient\nb) secondly (maybe not a super valid argument for you): netrc is not \nconsidered to be the most secure thing, isn't it? Our network is invaded \nevery year \"tested\" by thousands of computer science students, so i \nalways try to have as few plain-text passwords as possible lying around \n(one never knows - yes netrc has 0600).\n\ni'd also prefer not to use the user:pass@server schema, but to be asked, \nto not show pass in the history and config file in .git although even \nuser:pass@server would be an advantage because it solves a).\n\nJürgen\n"},{"id":"86515","messageId":"489C67F0.6090609@univie.ac.at","threadId":"14848","inReplyTo":"48998AC7.20204@univie.ac.at","subject":"Re: do without .netrc","fromName":"Jürgen Mangler","fromEmail":"juergen.mangler@univie.ac.at","sentAt":"2008-08-08T15:36:16Z","receivedAt":"2008-08-08T15:36:16Z","isPatch":false,"sender":{"key":"juergen.mangler@univie.ac.at","avatar":null},"body":"> The advantages for me would be:\n> \n> a) I have multiple different passwords on the same server for different \n> directories, it's not possible to put this to a netrc (AS FAR AS I \n> KNOW). So i have to edit the netrc for every push, clone, ... -> very \n> inconvenient\n> b) secondly (maybe not a super valid argument for you): netrc is not \n> considered to be the most secure thing, isn't it? Our network is invaded \n> every year \"tested\" by thousands of computer science students, so i \n> always try to have as few plain-text passwords as possible lying around \n> (one never knows - yes netrc has 0600).\n> \n> i'd also prefer not to use the user:pass@server schema, but to be asked, \n> to not show pass in the history and config file in .git although even \n> user:pass@server would be an advantage because it solves a).\n\nValid solutions would therefore include:\n\n* allow http://user@server urls, and ask user for password (A-rated)\n* provide for http.basic.user and http.basic.pass in .git/config file \n(B-rated, one has to take care about the security of his config file)\n* allow http://user:pass@server urls (C-rated, the consequences have \nbeen discussed on this list several times)\n\nJürgen\n"}]}