Re: [REGRESSION 2.10.2] problematic "empty auth" changes

From: Junio C Hamano <gitster@pobox.com>
Date: Dec 9, 2016, 19:31 UTC
Message-ID: <xmqqoa0krjaf.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <alpine.DEB.2.20.1612091048540.23160@virtualbox>

Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:

Show 10 quoted lines

> It would be different, of course, if http.emptyAuth would *not* allow the
> user to type their credentials when accessing something like
> https://github.com/dscho/shhh-secret-repository, *only* trying the login
> credentials. But that is not the case, with http.emptyAuth=true, login
> credentials are attempted first, and when they fail, the user is still
> asked interactively for their credentials.
>
> All I can see is that this would be *an improvement*: corporate users
> trying to access a Git repository that requires their login credentials
> would now not even need to enter empty user name/password.

Yup, my thought process after seeing your first message to David exactly mirrored the above two paragraphs. It sounds like you two have a good plan ;-)

Thanks.

Show 14 quoted lines

> This alone would be already a good reason to change the default, IMHO.
>
> So here is my plan:
>
> - change the default of http.emptyAuth to true in the next Git for Windows
>   version
>
> - publish a prerelease for early adopters to test
>
> - contribute this patch here on the Git mailing list, in the hope that it
>   will make it into the next major version
>
> Ciao,
> Dscho