From: Junio C Hamano Date: Thu, 24 Nov 2005 22:14:15 GMT Subject: Re: [PATCH] Support username and password inside URL Message-ID: <7vbr09n16w.fsf@assigned-by-dhcp.cox.net> In-Reply-To: <87d5kraxsr.fsf@litku.valo.iki.fi> Kalle Valo writes: > Actually I'm going to be only user of the private git repository and > it's going to be permanent. I have multiple computers in different > locations (servers, workstations, laptops) and I would like to > distribute my private files (configuration files, scripts etc.) to all > of them using git. Fair enough. Is "git-push ssh://these.machines/" (or from these.machines "git-fetch ssh://mother.ship/") more trouble than having HTTP server on your mother ship machine? > ... The problem with randomized URL (like you > suggested) is that if some person or a search engine finds the URL > somehow, then there's nothing stopping the information leak. Hmph. I had an impression that the obscure URL scheme like in my example http://members.cox.net/junkio/r0ZIEF/5S54m/ is as robot safe as auth embedding URL. That is, if somebody feeds auth-embedding URL to robots I suspect they can follow it just fine. Of course obscure URL needs to be protected by forbidding dirindex at higher level directories and not posting it to public forum [*1*], for the same reason you have to keep the auth embedding URL from public. [Footnote] *1* I suspect some robots have already tried to harvest what is found at that URL since I posted the message to the list.