git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] documentation: add git transport security notice

From
Fredrik Gustafsson <iveqy@iveqy.com>
Date
Jun 24, 2013, 22:27 UTC
Message-ID
<20130624222703.GA32270@paksenarrion.iveqy.com>
In-Reply-To
<20130624215733.GU2457@bacardi.hollandpark.frase.id.au>
On Tue, Jun 25, 2013 at 07:57:35AM +1000, Fraser Tweedale wrote:
>  The git transport is insecure and should be used with caution on
>  unsecured networks.
I don't understand this. How is git:// insecure?

It's protocol with no authentication, because it's a protocol used for public sharing.

The only point of encrypt git:// would be to verify that the recieved data has not been altered along the way. However you can always trust that the end result is an valid copy of the remote.

To me that means that it's as secure as a non-authentication protocoll needs to be.

How would an "evil network" be able to do any harm to a git transport over git://?

-- 
Med vänliga hälsningar
Fredrik Gustafsson

tel: 0733-608274
e-post: iveqy@iveqy.com
Previous: Fraser TweedaleNext: Junio C Hamano
Message 4 of 7 in “documentation: add git transport security notice”
  1. documentation: add git transport security noticeFraser Tweedale, Jun 24, 2013
  2. Junio C HamanoJun 24, 2013
  3. Fraser TweedaleJun 24, 2013
  4. Fredrik GustafssonJun 24, 2013
  5. Junio C HamanoJun 24, 2013
  6. Fredrik GustafssonJun 24, 2013
  7. Junio C HamanoJun 24, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.