{"thread":{"id":"61892","subject":"git \"security\" overengineering (reaction to safe.directory)","startedAt":"2024-08-02T11:30:16Z","lastAt":"2024-08-02T11:30:16Z","messageCount":1,"participants":["Costa Shapiro"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"499939","messageId":"DDA0EFF6-64F3-48A4-A99F-F0148FC0BCCE@mouldwarp.com","threadId":"61892","inReplyTo":null,"subject":"git \"security\" overengineering (reaction to safe.directory)","fromName":"Costa Shapiro","fromEmail":"costa@mouldwarp.com","sentAt":"2024-08-02T11:30:12Z","receivedAt":"2024-08-02T11:30:16Z","isPatch":false,"sender":{"key":"costa@mouldwarp.com","avatar":null},"body":"I think the breaking feature of `safe.directory` config -- within the basic CLI\nis a dubious development decision.\n\nThe thing is, `git` is fine as it's been for the last few years, and it doesn't\nreally need any features, especially breaking ones.\nThis is, of course, boring for its current maintainers, dealing with just\nthe bugs and optimisations, I can totally relate to that, and I'm forever\ngrateful for their selfless work, still, sometimes, enhancement is not\nthe answer -- but instead, modularisation is.\n\nSo, I think this *breaking* \"security\" feature is a bit too much now that I've\nstumbled upon it for the second time recently -- this time, within a \"ruby-git\"\nRuby gem suddenly failing on me (as I'm sure there are many `git`-CLI-based\ncomponent's users being confused and unhappy as I write this) -- following years\nof being a happy user (and an actual promoter of healthy git-based dev processes,\nsee https://medium.com/@costa/git-decentralized-a25f00fd2955 for instance)\nand I have to speak up.\n\nI know a thing or two about security, and one of those things that I know is that\nyou cannot improve security for ignorant people, unless you\neither (a) really restrict their actions, or (b) properly educate them.\n\nThe reasoning I've seen for this feature that I've seen talks about users being\ntoo smart about their shell prompts and being too stupid about going into some\nmaliciously crafted git repos' working directories. Well, this looks like a very\nspecific (even exotic) case to me -- for bringing a whole new aspect into\nthe core git functionality -- especially if you consider the vast (and I mean\n*vast*) majority of git usages. But even if we take this very seriously,\nand decide that this should go into the very basic git functionality\n-- instead of, you know, easily wrapping `git` within an interface component,\nCLI or not -- with this aspect taken care of; even so, we won't help\nthe ignorant users, who would just google the \"dubious ownership\" error, arrive\nat the common advice of `git config --global --add safe.directory '*'` -- from\nthe search results page, not even going into the source info web page -- and go\nback to their \"insecure\" comfort zone.\n\nTo summarise, I think that this \"extra\" functionality (and actually complex\nsecurity aspect in general) should be removed from the basic git CLI.\nAnd again, kudos to the maintainers who are mostly just the best.\n"}]}