git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: optimising a push by fetching objects from nearby repos

From
milki <milki@rescomp.berkeley.edu>
Date
May 10, 2014, 17:32 UTC
Message-ID
<20140510173226.GA27483@hal.rescomp.berkeley.edu>
In-Reply-To
<20140510172338.GB45511@vauxhall.crustytoothpaste.net>
On 17:23 Sat 10 May     , brian m. carlson wrote:
Show 11 quoted lines
> I don't believe this is possible.  There has been some discussion on
> related matters at least fairly recently, though.
> 
> Part of the reason nobody has implemented this is because it exposes
> additional security concerns.  If I create a commit that references an
> object I don't own, but is in someone else's repository, this feature
> could allow me to gain access to objects which I shouldn't have access
> to unless the authentication and permissions layer is very, very
> careful.  This would make many very simple HTTPS and SSH setups much
> more complex.  Alternates don't have this problem because they're done
> server-side.

If this were implemented service side and specified with, say, a config option, would this security concern go away?

-- 
milki
Previous: brian m. carlsonNext: brian m. carlson
Message 4 of 13 in “optimising a push by fetching objects from nearby repos”
  1. Sitaram ChamartyMay 10, 2014
  2. Duy NguyenMay 10, 2014
  3. brian m. carlsonMay 10, 2014
  4. milkiMay 10, 2014
  5. brian m. carlsonMay 10, 2014
  6. Junio C HamanoMay 10, 2014
  7. Sitaram ChamartyMay 11, 2014
  8. Storm-Olsen, MariusMay 11, 2014
  9. Sitaram ChamartyMay 11, 2014
  10. Storm-Olsen, MariusMay 11, 2014
  11. Sitaram ChamartyMay 11, 2014
  12. Junio C HamanoMay 11, 2014
  13. Sitaram ChamartyMay 12, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.