Re: [PATCH] fetch: Strip usernames from url's before storing them
- From
Andreas Ericsson <ae@op5.se>
- Date
- Apr 15, 2009, 18:08 UTC
- Message-ID
- <49E62295.3070100@op5.se>
- In-Reply-To
- <7viql5vnqd.fsf@gitster.siamese.dyndns.org>
Junio C Hamano wrote:
Show 8 quoted lines
> Andreas Ericsson <ae@op5.se> writes: > >> The reason for this patch is that we published some repositories publicly >> a week or two ago and one such malicious person started attacking all our >> public servers with the usernames found in the commit messages. > > Interesting. Do you also worry about the names on committer and author > lines?
We don't refuse anyone who's allowed to push by file-permissions. Perhaps we should, but we don't. This was discovered as a nasty after-shock, and "unfortunately" a bunch of people are already working with the commits exposed by the code. Since we're not really affected at all by the bad parts of the code, we've decided not to bother rewriting history. We'd rather keep life simple for our contributors (we're not as lively a community as git, so we can't afford to lose half a dozen just to protect ourselves; It's better to just alter those usernames and keep going with the history we've got).
-- Andreas Ericsson andreas.ericsson@op5.se OP5 AB www.op5.se Tel: +46 8-230225 Fax: +46 8-230231 Considering the successes of the wars on alcohol, poverty, drugs and terror, I think we should give some serious thought to declaring war on peace.