threads / discuss / 60576

git:// warn as connection not secure

Subject: git:// warn as connection not secure

## tl;dr

3 messages between Dec 1, 2023 and Dec 5, 2023.

replies: 2people: 2as markdown or json

Jonny Grant· Dec 1, 2023, 11:57 UTC · lore

Hello May I ask if anyone has suggested adding a default warning that git:// is not a secure connection?

ie "warning: git:// is not a secure connection. https and ssh are secure."

$ git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Cloning into 'linux'... remote: Enumerating objects: 9863119, done. remote: Counting objects: 100% (2360/2360), done. remote: Compressing objects: 100% (1282/1282), done. ^Cceiving objects: 0% (8779/9863119), 3.21 MiB | 6.41 MiB/s

Kind regards Jonny

Eric Wong· Dec 1, 2023, 21:24 UTC · re: Jonny Grant · lore

Re: git:// warn as connection not secure

Jonny Grant <jg@jguk.org> wrote:

> Hello
> May I ask if anyone has suggested adding a default warning that git:// is not a secure connection?
> 
> ie "warning: git:// is not a secure connection. https and ssh are secure."

To be accurate, that would need an exclusion list of hosts behind already-encrypted and trusted networks. So stuff like .onion hostnames for Tor, and a user-configurable list of hosts in a private LAN/VPN.

Jonny Grant· Dec 5, 2023, 20:42 UTC · re: Eric Wong · lore

Re: git:// warn as connection not secure

On 01/12/2023 21:24, Eric Wong wrote:

Show 9 quoted lines

> Jonny Grant <jg@jguk.org> wrote:
>> Hello
>> May I ask if anyone has suggested adding a default warning that git:// is not a secure connection?
>>
>> ie "warning: git:// is not a secure connection. https and ssh are secure."
> 
> To be accurate, that would need an exclusion list of hosts behind
> already-encrypted and trusted networks.  So stuff like .onion hostnames
> for Tor, and a user-configurable list of hosts in a private LAN/VPN.

That sounds good Eric.

Or even just an info message?

"info: git:// itself is an unencrypted connection. https and ssh are secure."

Kind regards Jonny