Re: [PATCH] Authentication support for pserver

From: Martin Langhoff <martin.langhoff@gmail.com>
Date: Dec 18, 2007, 20:39 UTC
Message-ID: <46a038f90712181239g3c6fe69bs822fd689d4628b5@mail.gmail.com>
In-Reply-To: <46a038f90712180141x2f27e6cei5ef53339fd3f90dc@mail.gmail.com>

On Dec 18, 2007 10:41 PM, Martin Langhoff <martin.langhoff@gmail.com> wrote:

>  - git/config is very likely to be readable if the site is served via
> other means, like dumb http protocol, or git+ssh. So even if the
> password scrambling is mickey-mouse. it might make sense to force the
> password data to live elsewhere.

On this aspect, I see no reason why we wouldn't have the passwords crypt()ed or SHA1'd. Perl includes crypt() in the default distribution, so it wouldn't add any dependency.

The protocol may be ROT13'ing the passwords, but we don't have to double-ROT13 them in our storage format ;-)

cheers,

martin

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.