git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: git:// protocol over SSL/TLS

From
Sergey Sharybin <sergey.vfx@gmail.com>
Date
Dec 27, 2013, 14:18 UTC
Message-ID
<CAErtv26WEYXPpi2D=54NfxfYKBFMKhExHKkWL0EWP_ZCUPEiXA@mail.gmail.com>
In-Reply-To
<87mwjm4c3s.fsf@igel.home>

Our sysadmns are mainly worried about possible MITM which might give users completely wrong repo.

For sure users might simply compare hash of HEAD from https'ed site with repo browser with what they've got in the checkout. But that's an extra step which we'd like to avoid without security harm :)

On Fri, Dec 27, 2013 at 8:12 PM, Andreas Schwab <schwab@linux-m68k.org> wrote:
Show 15 quoted lines
> Sergey Sharybin <sergey.vfx@gmail.com> writes:
>
>> So guess we just need to recommend using https:// protocol instead of
>> git:// for our users?
>
> Given how easy it is to verify the integrity of a git repository out of
> band there isn't really much of added security by using TLS for
> transport.
>
> Andreas.
>
> --
> Andreas Schwab, schwab@linux-m68k.org
> GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
> "And now for something completely different."
-- 
With best regards, Sergey Sharybin
Previous: Konstantin KhomoutovNext: Matthieu Moy
Message 7 of 21 in “git:// protocol over SSL/TLS”
  1. Sergey SharybinDec 27, 2013
  2. Andreas SchwabDec 27, 2013
  3. Konstantin KhomoutovDec 27, 2013
  4. Sergey SharybinDec 27, 2013
  5. Andreas SchwabDec 27, 2013
  6. Konstantin KhomoutovDec 27, 2013
  7. Sergey SharybinDec 27, 2013
  8. Matthieu MoyDec 27, 2013
  9. Sergey SharybinDec 27, 2013
  10. Konstantin KhomoutovDec 27, 2013
  11. Sergey SharybinDec 27, 2013
  12. Konstantin KhomoutovDec 27, 2013
  13. Jeff KingDec 28, 2013
  14. Bernhard R. LinkDec 27, 2013
  15. Sergey SharybinDec 28, 2013
  16. brian m. carlsonDec 28, 2013
  17. Andreas SchwabDec 27, 2013
  18. Pyeron, Jason J CTR (US)Dec 27, 2013
  19. Konstantin KhomoutovDec 27, 2013
  20. Junio C HamanoDec 27, 2013
  21. Ilari LiusvaaraDec 28, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.