From: Jürgen Mangler <juergen.mangler@univie.ac.at>
Date: Fri, 08 Aug 2008 15:36:16 GMT
Subject: Re: do without .netrc
Message-ID: <489C67F0.6090609@univie.ac.at>
In-Reply-To: <48998AC7.20204@univie.ac.at>

> The advantages for me would be:
> 
> a) I have multiple different passwords on the same server for different 
> directories, it's not possible to put this to a netrc (AS FAR AS I 
> KNOW). So i have to edit the netrc for every push, clone, ... -> very 
> inconvenient
> b) secondly (maybe not a super valid argument for you): netrc is not 
> considered to be the most secure thing, isn't it? Our network is invaded 
> every year "tested" by thousands of computer science students, so i 
> always try to have as few plain-text passwords as possible lying around 
> (one never knows - yes netrc has 0600).
> 
> i'd also prefer not to use the user:pass@server schema, but to be asked, 
> to not show pass in the history and config file in .git although even 
> user:pass@server would be an advantage because it solves a).

Valid solutions would therefore include:

* allow http://user@server urls, and ask user for password (A-rated)
* provide for http.basic.user and http.basic.pass in .git/config file 
(B-rated, one has to take care about the security of his config file)
* allow http://user:pass@server urls (C-rated, the consequences have 
been discussed on this list several times)

Jürgen