From: Junio C Hamano Date: Sun, 26 Aug 2007 21:22:12 GMT Subject: Re: git-daemon on NSLU2 Message-ID: <7vtzqmng8r.fsf@gitster.siamese.dyndns.org> In-Reply-To: Linus Torvalds writes: >> I'm not buying the security argument. If you want something kept hidden >> get it out of the public db. If I know the sha of the hidden object >> can't I just add a head for it and git-deamon will happily send it and >> the chain up to it to me? > > That's a particularly idiotic statement. > > If you know the SHA1, there can *by*definition* not be any hidden objects. > The SHA1 depends on the object chain. I think what we have is even stronger --- upload-pack does not allow asking for an arbitrary commit. The requesting fetch-pack side needs to pick from what are offerred, and upload-pack makes sure of that.