Re: [RFC] Adding a challenge-response authentication method to git://

From: Stephen R. van den Berg <srb@cuci.nl>
Date: Aug 14, 2008, 12:14 UTC
Message-ID: <20080814121412.GA25791@cuci.nl>
In-Reply-To: <20080814113901.GR10151@machine.or.cz>

Petr Baudis wrote:

>On Thu, Aug 14, 2008 at 01:07:39PM +0200, Stephen R. van den Berg wrote:
>> Well, I looked into gitosis, and it solves part of the problem, it has a
>> few downsides though:

>> - It depends on Python for no particular reason (it might as well have
>>   been built using shellscripts only, or if need be Perl, since git
>>   already uses that); yet any extra dependency is creating an extra
>>   hurdle for portability and adoption.

Show 5 quoted lines

>Is this concern really any kind of practical one? To me it appears that
>Python and Perl are both so extremely wide-spread that this might be
>issue only on embedded systems, exotic systems with very low proportion
>of git users, and users with strong ideological opinions about the
>system (probably low proportion of git users too).

I agree that in general it shouldn't be a major problem to get it on the systems you want to use it on; but it does increase the difficulty of auditing the solution before deploying it.

>> Other than that, gitosis looks fairly good if you want to use public
>> keys.

>This doesn't seem to be convincing reason for _reimplementing_ the
>solution. (Of course, I don't prevent you from doing that, I'm just
>wondering about the feasibility.)

I'm not going to reimplement gitosis. I'm going to do *less* than gitosis for situations where gitosis is undesirable (for whatever reason, not necessarily the critisisms I mentioned before).

-- 
Sincerely,
           Stephen R. van den Berg.

"Hold still, while I inject you with SQL."