git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: The git protocol and DoS

From
TLTony Luck <tony.luck@gmail.com>
Date
Oct 19, 2005, 22:39 UTC
Message-ID
<12c511ca0510191539w3dd76f89ra5fe48e1d84750d6@mail.gmail.com>
In-Reply-To
<20051019222044.GP30889@pasky.or.cz>
On 10/19/05, Petr Baudis <pasky@suse.cz> wrote:
> [client]        git-upload-pack <path>
> [server]        challenge somethingnonsensical
> [client]        challenge-response <username>:sha1(somethingnonsensical<password>)
> [server]        All right, the pack goes like this...

I think this requires that the server store the cleartext version of the password so that it can validate sha1(somethingnonsensical<password>) ... which is generally thought to be a bad idea.

-Tony
Previous: Petr BaudisNext: David Brown
Message 10 of 12 in “The git protocol and DoS”
  1. H. Peter AnvinOct 19, 2005
  2. Junio C HamanoOct 19, 2005
  3. H. Peter AnvinOct 19, 2005
  4. Junio C HamanoOct 19, 2005
  5. H. Peter AnvinOct 19, 2005
  6. Linus TorvaldsOct 19, 2005
  7. Junio C HamanoOct 19, 2005
  8. H. Peter AnvinOct 19, 2005
  9. Petr BaudisOct 19, 2005
  10. Tony LuckOct 19, 2005
  11. David BrownOct 20, 2005
  12. Andreas EricssonOct 20, 2005

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.