Re: [PATCH 0/3] Advertise OS version
- From
- Dragan Simic <dsimic@manjaro.org>
- Date
- Jun 19, 2024, 13:50 UTC
- Message-ID
- <04b714d3e949c30bae0e26231e923fc4@manjaro.org>
- In-Reply-To
- <20240619134533.GA943023@coredump.intra.peff.net>
Hello Jeff,
On 2024-06-19 15:45, Jeff King wrote:
Show 31 quoted lines
> On Wed, Jun 19, 2024 at 03:18:40PM +0200, Dragan Simic wrote: >> On 2024-06-19 14:57, Christian Couder wrote: >> > For debugging and statistical purposes, it can be useful for Git >> > servers to know the OS the client are using. >> > >> > So let's add a new 'os-version' capability to the v2 protocol, in the >> > same way as the existing 'agent' capability that lets clients and >> > servers exchange the Git version they are running. >> > >> > This sends the same info as `git bugreport` is already sending, which >> > uses uname(2). It should be the same as what `uname -srvm` returns, >> > except that it is sanitized in the same way as the Git version sent by >> > the 'agent' capability is sanitized (by replacing character having an >> > ascii code less than 32 or more than 127 with '.'). >> >> This may probably be a useful debugging feature, but I strongly >> suggest that a configuration knob exists that makes disabling it >> possible. For security reasons, some users may not want to >> publicly advertise their OSes and kernel versions. Count me in >> as one of such users. :) > > Agreed. We do send the Git version, which is already a slight privacy > issue (though it can be overridden at both build-time and run-time). > But > OS details seems like crossing a line to me. > > I don't mind if this is present but disabled by default, but then I > guess it is not really serving much of a purpose, as hardly anybody > would enable it. Which makes collecting large-scale statistics by > hosting providers pretty much useless (and I don't think it is all that > useful for debugging individual cases).
I agree that it should actually be disabled by default, for privacy and security reasons, but that would actually defeat its purpose, so I'm not really sure should it be merged.