git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] documentation: add git transport security notice

From
Fredrik Gustafsson <iveqy@iveqy.com>
Date
Jun 24, 2013, 22:47 UTC
Message-ID
<20130624224708.GB32270@paksenarrion.iveqy.com>
In-Reply-To
<7vtxkn5e8o.fsf@alter.siamese.dyndns.org>
On Mon, Jun 24, 2013 at 03:35:19PM -0700, Junio C Hamano wrote:
Show 9 quoted lines
> > I don't understand this. How is git:// insecure?
> 
> If your DNS is poisoned, or your router is compromised to allow your
> traffic diverted, you may be fetching from somewhere you did not
> intend to.  As I explained in a separate message, that does not
> necessarily result in your repository corrupting, but the result,
> even though it may be "git fsck" clean at the bit level, needs
> additional validation measure, such as signed tags, to be safely
> used to base your further work on top.

Thanks for the explanation. Of course you need to verify your latest commit sha1 against a trustworthy source. That would be enough to prevent this scenario, yes?

If we add warnings for git:// should we also add warnings for http://? Or do we consider that common knowledge?

-- 
Med vänliga hälsningar
Fredrik Gustafsson

tel: 0733-608274
e-post: iveqy@iveqy.com
Previous: Junio C HamanoNext: Junio C Hamano
Message 6 of 7 in “documentation: add git transport security notice”
  1. documentation: add git transport security noticeFraser Tweedale, Jun 24, 2013
  2. Junio C HamanoJun 24, 2013
  3. Fraser TweedaleJun 24, 2013
  4. Fredrik GustafssonJun 24, 2013
  5. Junio C HamanoJun 24, 2013
  6. Fredrik GustafssonJun 24, 2013
  7. Junio C HamanoJun 24, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.