git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Proposal: server-advertised config options

From
Junio C Hamano <gitster@pobox.com>
Date
Sep 10, 2020, 04:27 UTC
Message-ID
<xmqqr1ras1bn.fsf@gitster.c.googlers.com>
In-Reply-To
<20200910014520.GJ241078@camp.crustytoothpaste.net>
"brian m. carlson" <sandals@crustytoothpaste.net> writes:
> ...  We've seen security
> problems in the past with .gitmodules multiple times because it's
> server-sent config (in the repository).

Exactly. For some reason some people still seem to think that it is wasteful that we force users to approve/reject copying from .gitmodules to .git/config and push to read and use settings directly from the former---I think it is a huge mistake.

> As a result, I'm very much opposed to allowing any config options to be
> copied from the server.
+1.
> It's also the standard approach that every project uses already, and it
> has the benefit that the user can inspect it at their leisure before
> running it.
+100 ;-)
Previous: brian m. carlson
Message 9 of 9 in “Proposal: server-advertised config options”
  1. Drew DeVaultSep 7, 2020
  2. Christian CouderSep 7, 2020
  3. Drew DeVaultSep 7, 2020
  4. Junio C HamanoSep 7, 2020
  5. Drew DeVaultSep 7, 2020
  6. brian m. carlsonSep 7, 2020
  7. Drew DeVaultSep 8, 2020
  8. brian m. carlsonSep 10, 2020
  9. Junio C HamanoSep 10, 2020

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.