From: Andreas Ericsson <ae@op5.se>
Date: Thu, 10 Jul 2008 11:30:47 GMT
Subject: Re: [PATCH] Fix problem with authentification on http repository.
Message-ID: <4875F2E7.1010209@op5.se>
In-Reply-To: <alpine.DEB.1.00.0807101248360.3135@eeepc-johanness>

Johannes Schindelin wrote:
> Hi,
> 
> On Thu, 10 Jul 2008, Jeff King wrote:
> 
>> On Wed, Jul 09, 2008 at 01:43:07PM +0200, Johannes Schindelin wrote:
>>
>>>> Note that http://user:pass@server/path/ /should/ work (but that 
>>>> would need validation), though not a good idea on command line.
>>> Well, now that the programs using URLs are all builtins, we can 
>>> actually do something about it.  We can edit out the "user[:pass]@" 
>>> part out of argv, which usually means that "ps" will not see it 
>>> anymore.
>> Wouldn't there still be a race condition for publicly broadcasting your 
>> password via ps?
> 
> Yes.  For a brief amount of time, but yes.
> 
> BTW I thought I remembered one program xxx'ing out the password via argv, 
> but unfortunately I do not remember which one it was.
> 

The mysql client does (or did) it, although perhaps only on systems that
support it.

-- 
Andreas Ericsson                   andreas.ericsson@op5.se
OP5 AB                             www.op5.se
Tel: +46 8-230225                  Fax: +46 8-230231