{"thread":{"id":"34279","subject":"[PATCH] documentation: add git transport security notice","startedAt":"2013-06-26T05:53:59Z","lastAt":"2013-06-26T05:53:59Z","messageCount":1,"participants":["Fraser Tweedale"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"222008","messageId":"1372226039-31689-1-git-send-email-frase@frase.id.au","threadId":"34279","inReplyTo":null,"subject":"[PATCH] documentation: add git transport security notice","fromName":"Fraser Tweedale","fromEmail":"frase@frase.id.au","sentAt":"2013-06-26T05:53:59Z","receivedAt":"2013-06-26T05:53:59Z","isPatch":true,"sender":{"key":"frase@frase.id.au","avatar":"https://avatars.githubusercontent.com/u/2331938?v=4"},"body":"The fact that the git transport does not do any authentication is\neasily overlooked.  For example, DNS poisoning may result in\nfetching from somewhere that was not intended.\n\nAdd a brief security notice to the \"GIT URLS\" section\nof the documentation stating that the git transport should be used\nwith caution on unsecured networks.\n\nSigned-off-by: Fraser Tweedale <frase@frase.id.au>\n---\n Documentation/urls.txt | 3 +++\n 1 file changed, 3 insertions(+)\n\ndiff --git a/Documentation/urls.txt b/Documentation/urls.txt\nindex 3ca122f..b58a647 100644\n--- a/Documentation/urls.txt\n+++ b/Documentation/urls.txt\n@@ -11,6 +11,9 @@ and ftps can be used for fetching and rsync can be used for fetching\n and pushing, but these are inefficient and deprecated; do not use\n them).\n \n+The git transport does not do any authentication and should be used\n+with caution on unsecured networks.\n+\n The following syntaxes may be used with them:\n \n - ssh://{startsb}user@{endsb}host.xz{startsb}:port{endsb}/path/to/repo.git/\n-- \n1.8.3.1\n"}]}