git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: The git protocol and DoS

From
Junio C Hamano <junkio@cox.net>
Date
Oct 19, 2005, 20:50 UTC
Message-ID
<7vmzl544f3.fsf@assigned-by-dhcp.cox.net>
In-Reply-To
<4356A5C5.5080905@zytor.com>
"H. Peter Anvin" <hpa@zytor.com> writes:
> It would, however, require a protocol change; I would like to hear what 
> people think about this at this stac=ge.

Well, it is full two days since a majorly visible git protocol enabled server has been announced, and you probably know what kind of hits you are getting (and please let us know if you have numbers, I am curious). If we do a protocol change, earlier the better. You already said that the kernel.org git is experimental. Does anybody run git daemons and rely on the current protocol?

I suspect it would not make *any* sense to have a backward compatible server that optionally allows this cookie exchange -- attackers can just say "I am an older client". OTOH, it probably makes sense to have an option on the client side to skip the cookie exchange stage. I do not think autodetecting new/old server on the client side in connect.c is possible.

Previous: H. Peter AnvinNext: H. Peter Anvin
Message 2 of 12 in “The git protocol and DoS”
  1. H. Peter AnvinOct 19, 2005
  2. Junio C HamanoOct 19, 2005
  3. H. Peter AnvinOct 19, 2005
  4. Junio C HamanoOct 19, 2005
  5. H. Peter AnvinOct 19, 2005
  6. Linus TorvaldsOct 19, 2005
  7. Junio C HamanoOct 19, 2005
  8. H. Peter AnvinOct 19, 2005
  9. Petr BaudisOct 19, 2005
  10. Tony LuckOct 19, 2005
  11. David BrownOct 20, 2005
  12. Andreas EricssonOct 20, 2005

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.