From: Junio C Hamano <gitster@pobox.com>
Date: Thu, 20 Dec 2012 18:49:52 GMT
Subject: Re: RFC: "git config -l" should not expose sensitive information
Message-ID: <7vbodo5zjj.fsf@alter.siamese.dyndns.org>
In-Reply-To: <50D33409.1050309@alum.mit.edu>

Michael Haggerty <mhagger@alum.mit.edu> writes:

> I think the problem is yet another step earlier: why do we build tools
> that encourage people to store passwords in plaintext in a configuration
> file that is by default world-readable?

True.  This particular one mentioned in the thread predates
credential helpers, so it is not faire to say "encourage".
We didn't and we don't.

Care to do a patch to deprecate sendemail.smtppass (i.e. give
warnings to users when it is used) and perhaps replace it with
something based on the credential store or something?