# git:// warn as connection not secure 3 messages from 2023-12-01 to 2023-12-05. Participants: Jonny Grant, Eric Wong. Thread: https://gitlist.dev/t/60576 ## Jonny Grant, 2023-12-01 11:57 Subject: git:// warn as connection not secure Message-ID: URL: https://gitlist.dev/e/b6e0f49a-34ff-4e8e-9c3e-b8fd41d59f68%40jguk.org ``` Hello May I ask if anyone has suggested adding a default warning that git:// is not a secure connection? ie "warning: git:// is not a secure connection. https and ssh are secure." $ git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Cloning into 'linux'... remote: Enumerating objects: 9863119, done. remote: Counting objects: 100% (2360/2360), done. remote: Compressing objects: 100% (1282/1282), done. ^Cceiving objects: 0% (8779/9863119), 3.21 MiB | 6.41 MiB/s Kind regards Jonny ``` ## Eric Wong, 2023-12-01 21:24 Subject: Re: git:// warn as connection not secure Message-ID: <20231201212423.M738201@dcvr> URL: https://gitlist.dev/e/20231201212423.M738201%40dcvr In-Reply-To: ``` Jonny Grant wrote: > Hello > May I ask if anyone has suggested adding a default warning that git:// is not a secure connection? > > ie "warning: git:// is not a secure connection. https and ssh are secure." To be accurate, that would need an exclusion list of hosts behind already-encrypted and trusted networks. So stuff like .onion hostnames for Tor, and a user-configurable list of hosts in a private LAN/VPN. ``` ## Jonny Grant, 2023-12-05 20:42 Subject: Re: git:// warn as connection not secure Message-ID: URL: https://gitlist.dev/e/ac8cf97f-53eb-43df-b95e-2d05753bf056%40jguk.org In-Reply-To: <20231201212423.M738201@dcvr> ``` On 01/12/2023 21:24, Eric Wong wrote: > Jonny Grant wrote: >> Hello >> May I ask if anyone has suggested adding a default warning that git:// is not a secure connection? >> >> ie "warning: git:// is not a secure connection. https and ssh are secure." > > To be accurate, that would need an exclusion list of hosts behind > already-encrypted and trusted networks. So stuff like .onion hostnames > for Tor, and a user-configurable list of hosts in a private LAN/VPN. That sounds good Eric. Or even just an info message? "info: git:// itself is an unencrypted connection. https and ssh are secure." Kind regards Jonny ```