3 ms·
Hi, You might not remember me. I'm the poster you're responding to. How have you been? Me, I'm all right. I was just thinking of when we first spoke… it seems
by falsedan 9y ago
Hi,
You might not remember me. I'm the poster you're responding to. How have you been? Me, I'm all right.
I was just thinking of when we first spoke… it seems like so long ago! I remember it as clearly as yesterday: you had made a partially-conherent argument that the auth creds for a git URL could leak into a remote deployment's reflog! Oh, how we laughed, and our amusement doubled in size as you fancied a implausible situation where the read-only deployment credentials could be recovered from the very same repo they allowed access to!
It was much later when we crossed paths again, but your talent for sharing inventive tales had not waned in the slightest. For this next performance, you regaled us with the simple truth that no person can be certain that their commit history will not reveal their darkest secrets, and thus should strictly eschew sharing it in a public place; but that the contents of their index was above suspicion, and could be shouted to the world without a moment's thought! Many of us stumbled to determine what byzantine process made the working directory automatically scrub itself of secrets, before finally the jape dawned on them.
I eagerly anticipate our next encounter; what fresh new hilarity will you share with us?
I hope my restatement of my understanding of your position helps make my position clear,
--falsedan
- _wmd 9y agoI guess we're both having a bad day. Let's break down the original statement: > git clone https://username:password@github.com/.. https://username:password@github.com/... This command produces a new git repository by cloning the supplied URL > will end up in git reflog The newly generated repository's reflog will contain the credentials passed on the command line. > so yes, it's a problem Assuming the newly generated repository also happens to be a static HTTP server root, which is the subject of the thread in which you've been posting
- falsedan 9y agoThanks, that makes it clear to me.