Re: [PATCH v2 4/4] sideband: add options to allow more control sequences to be passed through

> I hesitate to suggest this, but: we have a similar distinction already
> for protocol selection, where GIT_PROTOCOL_FROM_USER tells us whether
> the URL came directly from the user, or if we were directed there as
> part of an untrusted automated process (like a .gitmodules file).
>
> We use that to disallow file:// from .gitmodules without breaking "git
> clone file://" on the command line.
>
> So we _could_ use that as a signal here, to suggest that servers you
> feed on the command line (including remotes you've defined) are more
> trusted than ones that you may have been redirected to from a possibly
> malicious .gitmodules file.
>
> But I say "hesitate" because:
>
>   1. This is a convoluted scheme making heuristic assumptions about
>      trust. It was a not-so-bad way of compromising on the file://
>      thing, but it may not be worth the complications here.
>
>   2. The trust boundaries aren't quite the same anyway. If I feed
>      "https://evil.example.com" to Git manually, I can verify that
>      "https" is the URL and that is OK to use the HTTP protocol. But it
>      doesn't say anything about whether I trust example.com to write to
>      my terminal.
>
> So maybe a dumb direction, but just thinking out loud.