git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: RFC: "git config -l" should not expose sensitive information

From
Junio C Hamano <gitster@pobox.com>
Date
Dec 20, 2012, 18:49 UTC
Message-ID
<7vbodo5zjj.fsf@alter.siamese.dyndns.org>
In-Reply-To
<50D33409.1050309@alum.mit.edu>
Michael Haggerty <mhagger@alum.mit.edu> writes:
> I think the problem is yet another step earlier: why do we build tools
> that encourage people to store passwords in plaintext in a configuration
> file that is by default world-readable?

True. This particular one mentioned in the thread predates credential helpers, so it is not faire to say "encourage". We didn't and we don't.

Care to do a patch to deprecate sendemail.smtppass (i.e. give warnings to users when it is used) and perhaps replace it with something based on the credential store or something?

Previous: Jeff KingNext: Andrew Ardill
Message 9 of 10 in “RFC: "git config -l" should not expose sensitive information”
  1. Toralf FörsterDec 17, 2012
  2. Jeff KingDec 20, 2012
  3. Aaron SchrabDec 20, 2012
  4. Jeff KingDec 20, 2012
  5. Junio C HamanoDec 20, 2012
  6. Toralf FörsterDec 20, 2012
  7. Michael HaggertyDec 20, 2012
  8. Jeff KingDec 20, 2012
  9. Junio C HamanoDec 20, 2012
  10. Andrew ArdillDec 20, 2012

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.