From: Arun Raghavan Date: Fri, 15 Jan 2010 12:14:58 GMT Subject: Re: Removal of post-upload-hook Message-ID: <6f8b45101001150414r2661001ep10819b601953c05b@mail.gmail.com> In-Reply-To: <20100115115212.GA9221@Knoppix> 2010/1/15 Ilari Liusvaara : > On Fri, Jan 15, 2010 at 11:42:19AM +0530, Arun Raghavan wrote: >> >> Another thought - would it be acceptable to have a config option to >> enable/disable these types of hooks, so that people who are not >> affected by the problem or explicitly don't care can use them? Perhaps >> a core.allowInsecureHooks ? > > That enable/disable would have to ignore per-repo configuration, which > would make it behave differently from other options. Otherwise attacker > could just flip the setting... Alternatively, this could just be a build-time switch. -- Arun Raghavan http://arunraghavan.net/ (Ford_Prefect | Gentoo) & (arunsr | GNOME)