Re: GSoC resumable clone

From: Jeff King <peff@peff.net>
Date: Mar 11, 2011, 21:43 UTC
Message-ID: <20110311214346.GA19235@sigill.intra.peff.net>
In-Reply-To: <20110311205041.GA10210@LK-Perkele-VI.localdomain>

On Fri, Mar 11, 2011 at 10:50:41PM +0200, Ilari Liusvaara wrote:

Show 7 quoted lines

> > Sorry, I didn't mean to imply that it was limited to bundles. It would
> > support arbitrary URLs or schemes. See this thread for some past
> > discussion:
> 
> Security pitfall: You need a way to restrict URL schemes that can
> be specified from the remote. Some URL schemes are wildly unsafe
> to use that way (or just don't make sense).

Did you mean on the server end? Or the client?

If the server, then I think no, it's a client decision. If on the client end, then yes, but it's one of many criteria.

The server end provides specially-formed refs that mention alternate locations. The client decides which of those locations, if any, meet its criteria for mirroring, including but not limited to:

  1. Whether the client supports the protocol in question (not everybody
     will be able to torrent, for example).

  2. Whether the client's network allows it (e.g., restrictive proxies).

  3. Whether it meets the client's security requirements (e.g., we
     probably shouldn't accept file:// URLs at all).

But it's clear to me that the security decision is only one of many criteria, and that the client is in a much better place to make those decisions. And that some of those decisions are going to have to be configurable by the user.

So yes, I agree we shouldn't blindly follow URLs.

-Peff