From: Ramsay Jones <ramsay@ramsayjones.plus.com>
Date: Thu, 01 Dec 2016 16:06:51 GMT
Subject: Re: [PATCH 4/6] http: make redirects more obvious
Message-ID: <5a47c032-755d-ad11-390f-22ae19ca584a@ramsayjones.plus.com>
In-Reply-To: <20161201090428.pweq7slwujbne5hg@sigill.intra.peff.net>



On 01/12/16 09:04, Jeff King wrote:
> We instruct curl to always follow HTTP redirects. This is
> convenient, but it creates opportunities for malicious
> servers to create confusing situations. For instance,
> imagine Alice is a git user with access to a private
> repository on Bob's server. Mallory runs her own server and

Ahem, so Mallory is female? (-blush-) :(

ATB,
Ramsay Jones