4 ms·

FTP meet HTTPS: An easier way to talk to Github

11 points by telemachos 16y ago

GICodeWarrior 16y ago
If you add your ssh key to an ssh-agent you won't have to type the password for it each time and the password won't be stored anywhere. You do still have to trust the root user, but this is still way better than putting your password on disk.
- telemachos 16y ago
  Probably a good point, but my sense is that HTTP is the future (and faster) for git{hub}. I may be wrong about that. Based on the quick downvote, I am wrong. Fair enough, but I'm curious to know, is HTTP not more efficient/quick than ssh now for git? I thought it was.
  - GICodeWarrior 16y ago
    Connection overhead is small for both (if keep-alive is working on https), request/response overhead might be smaller for ssh but probably not terribly and they both use AES encryption (by default) for the transfer so they should be very similar in performance.
    - telemachos 16y ago
      Thanks for the reply. I updated the post to include your objection and point here.
  - kneath 16y ago
    HTTP is the future for git and github. It has several benefits and no downsides. 1. No SSH keys required (if you've worked with people on windows machines or newbies to the command line, you'll recognize this is a massive win) 2. The same URL can be used for anonymous clones and private pushes. So if you are granted commit access, all you have to do is `git push` — no more changing remote URLs. 3. We can use the same URL for the web as we can for clones. This is a nice hidden usability win. We're waiting for a couple of things (1.7.2+ to become default distribution, and caching of HTTP credentials) before we make a complete push. That isn't to say we're deprecating ssh or have any plans to. It just means that we'll be increasingly pushing HTTP as the default.
js2 16y ago
Git uses libcurl for its http support. Libcurl is what is looking at your .netrc. But really, use ssh and ssh-agent. (That reminds me, I really need to send in that libcurl patch which adds support for the OS X keychain.) - a dinosaur (thanks for making me feel old today)
- stevenbedrick 16y ago
  Please submit that patch- that'd be hugely useful!
poink 16y ago
Being behind a rather restrictive firewall at work, I certainly recognize the advantages of HTTP/HTTPS vs. SSH (or anything else). Still, when it comes to not having to remember or retype passwords for network connections, isn't that exactly SSH's strong suit? I'm all for espousing the advantages of the new thing, but isn't this one of HTTPS's major disadvantages, comparatively? I mean, my github password isn't stored in plaintext on disk anywhere, and I can still do whatever I want without a password (OK, one password per reboot) from any of my machines.
kree10 16y ago
"...back when dinosaurs walked the earth, people used this...for FTP sessions." How I wish this were true. Before I started doing freelance web development full-time, I figured FTP had died out in the 90s, just like telnet did. I now understand FTP remains the norm, and I waste hours dealing with it (then gripe about it on the Facebook group 7 Billion Strong Against FTP http://www.facebook.com/group.php?gid=130658460303379 http://www.facebook.com/group.php?gid=130658460303379 ).

11 points by telemachos 16y ago

If you add your ssh key to an ssh-agent you won't have to type the password for it each time and the password won't be stored anywhere. You do still have to trust the root user, but this is still way better than putting your password on disk.

telemachos 16y ago
Probably a good point, but my sense is that HTTP is the future (and faster) for git{hub}. I may be wrong about that. Based on the quick downvote, I am wrong. Fair enough, but I'm curious to know, is HTTP not more efficient/quick than ssh now for git? I thought it was.
- GICodeWarrior 16y ago
  Connection overhead is small for both (if keep-alive is working on https), request/response overhead might be smaller for ssh but probably not terribly and they both use AES encryption (by default) for the transfer so they should be very similar in performance.
  - telemachos 16y ago
    Thanks for the reply. I updated the post to include your objection and point here.
- kneath 16y ago
  HTTP is the future for git and github. It has several benefits and no downsides. 1. No SSH keys required (if you've worked with people on windows machines or newbies to the command line, you'll recognize this is a massive win) 2. The same URL can be used for anonymous clones and private pushes. So if you are granted commit access, all you have to do is `git push` — no more changing remote URLs. 3. We can use the same URL for the web as we can for clones. This is a nice hidden usability win. We're waiting for a couple of things (1.7.2+ to become default distribution, and caching of HTTP credentials) before we make a complete push. That isn't to say we're deprecating ssh or have any plans to. It just means that we'll be increasingly pushing HTTP as the default.

js2 16y ago

Git uses libcurl for its http support. Libcurl is what is looking at your .netrc. But really, use ssh and ssh-agent. (That reminds me, I really need to send in that libcurl patch which adds support for the OS X keychain.) - a dinosaur (thanks for making me feel old today)

stevenbedrick 16y ago
Please submit that patch- that'd be hugely useful!

poink 16y ago

Being behind a rather restrictive firewall at work, I certainly recognize the advantages of HTTP/HTTPS vs. SSH (or anything else). Still, when it comes to not having to remember or retype passwords for network connections, isn't that exactly SSH's strong suit? I'm all for espousing the advantages of the new thing, but isn't this one of HTTPS's major disadvantages, comparatively? I mean, my github password isn't stored in plaintext on disk anywhere, and I can still do whatever I want without a password (OK, one password per reboot) from any of my machines.

kree10 16y ago

"...back when dinosaurs walked the earth, people used this...for FTP sessions." How I wish this were true. Before I started doing freelance web development full-time, I figured FTP had died out in the 90s, just like telnet did. I now understand FTP remains the norm, and I waste hours dealing with it (then gripe about it on the Facebook group 7 Billion Strong Against FTP http://www.facebook.com/group.php?gid=130658460303379 http://www.facebook.com/group.php?gid=130658460303379 ).