Re: [PATCH 0/3] Advertise OS version

From: Jeff King <peff@peff.net>
Date: Jun 19, 2024, 13:45 UTC
Message-ID: <20240619134533.GA943023@coredump.intra.peff.net>
In-Reply-To: <0448495385b009f25a66b0712afb28f1@manjaro.org>

On Wed, Jun 19, 2024 at 03:18:40PM +0200, Dragan Simic wrote:

Show 21 quoted lines

> Hello Christian,
> 
> On 2024-06-19 14:57, Christian Couder wrote:
> > For debugging and statistical purposes, it can be useful for Git
> > servers to know the OS the client are using.
> > 
> > So let's add a new 'os-version' capability to the v2 protocol, in the
> > same way as the existing 'agent' capability that lets clients and
> > servers exchange the Git version they are running.
> > 
> > This sends the same info as `git bugreport` is already sending, which
> > uses uname(2). It should be the same as what `uname -srvm` returns,
> > except that it is sanitized in the same way as the Git version sent by
> > the 'agent' capability is sanitized (by replacing character having an
> > ascii code less than 32 or more than 127 with '.').
> 
> This may probably be a useful debugging feature, but I strongly
> suggest that a configuration knob exists that makes disabling it
> possible.  For security reasons, some users may not want to
> publicly advertise their OSes and kernel versions.  Count me in
> as one of such users. :)

Agreed. We do send the Git version, which is already a slight privacy issue (though it can be overridden at both build-time and run-time). But OS details seems like crossing a line to me.

I don't mind if this is present but disabled by default, but then I guess it is not really serving much of a purpose, as hardly anybody would enable it. Which makes collecting large-scale statistics by hosting providers pretty much useless (and I don't think it is all that useful for debugging individual cases).

-Peff