Re: [PATCH] fetch/push: document that private data can be leaked

From: Matt McCutchen <matt@mattmccutchen.net>
Date: Nov 14, 2016, 18:28 UTC
Message-ID: <1479148088.2406.27.camel@mattmccutchen.net>
In-Reply-To: <xmqq1syezs3g.fsf@gitster.mtv.corp.google.com>

On Sun, 2016-11-13 at 18:57 -0800, Junio C Hamano wrote:

Show 9 quoted lines

> Matt McCutchen <matt@mattmccutchen.net> writes:
> 
> > 
> >  Documentation/fetch-push-security.txt | 9 +++++++++
> 
> A new (consolidated) piece like this that can be included in
> multiple places is a good idea.  I wonder if the original
> description in "namespaces" thing can be moved here and then
> "namespaces" page can be made to also borrow from this?

I gave this a try.  New patch coming.

Show 18 quoted lines

> > --- /dev/null
> > +++ b/Documentation/fetch-push-security.txt
> > @@ -0,0 +1,9 @@
> > +SECURITY
> > +--------
> > +The fetch and push protocols are not designed to prevent a
> > malicious
> > +server from stealing data from your repository that you did not
> > intend to
> > +share. The possible attacks are similar to the ones described in
> > the
> > +"SECURITY" section of linkgit:gitnamespaces[7]. If you have
> > private data
> > +that you need to protect from the server, keep it in a separate
> > +repository.
> 
> Yup, and then "do not push to untrustworthy place without checking
> what you are pushing", too?

If there is no private data in the repository, then there is no need for the user to check what they are pushing. As I've indicated before, IMO manually checking each push would not be a workable security measure in the long term anyway.

Matt