4 ms·

It’s great for anonymous clones of public repos where I don’t care about signing in. I work a lot of public repos. I want anonymous reads and clones to be supe

It’s great for anonymous clones of public repos where I don’t care about signing in. I work a lot of public repos. I want anonymous reads and clones to be super easy on my users. I don’t like forcing people to log in just to read. I don’t care about encryption as the integrity of anonymous clones isn’t something I suspect will be abused.

Majestic121 5y ago
You don't have to force them to log in, replace with https:// https:// and it works anonymously as it did before
judge2020 5y ago
I said this in my top comment but https:// https:// also allows unauthenticated access while being encrypted, whereas git:// is unencrypted and can be MITM'd.
- prepend 5y ago
  I understand the differences. I don’t care about MITM git protocol attacks.
eptcyka 5y ago
Do you like your ISP being able to inject commits into your repo clones? There's nothing wrong with using HTTPS.
- quinnjh 5y ago
  Do you have any documentation on this?
  - snovv_crash 5y ago
    Raw git:// without SSH keys is unencrypted, like http. Http has had ISP injections since forever, so nothing stops this extending to git.
- prepend 5y ago
  I don’t consider that a reasonable risk. And even if it was, then I don’t care for repos I explicitly clone without using encryption. There’s a large set of “I don’t care” style projects where I’m just looking to grab a copy. So even if my ISP (or some nefarious jerk on the same WiFi) could MITM, I don’t care. Plus, I’m not aware of any attacks like this because of the whole git checksum thing it’s harder than injecting into http traffic. For stuff I care about, I log in.
  - eptcyka 5y ago
    I'd be interested to know what kind of a development environment do you have that allows you to download arbitrary source and don't get pwnd. If you're on Qubes, that's cool, but I think most contemporary toolchains for all contemporary languages will expose some kind of arbitrary code execution through their build tools. Which is of course a massive shame.

Majestic121 5y ago

You don't have to force them to log in, replace with https:// https:// and it works anonymously as it did before

judge2020 5y ago

I said this in my top comment but https:// https:// also allows unauthenticated access while being encrypted, whereas git:// is unencrypted and can be MITM'd.

prepend 5y ago
I understand the differences. I don’t care about MITM git protocol attacks.

eptcyka 5y ago

Do you like your ISP being able to inject commits into your repo clones? There's nothing wrong with using HTTPS.

quinnjh 5y ago
Do you have any documentation on this?
- snovv_crash 5y ago
  Raw git:// without SSH keys is unencrypted, like http. Http has had ISP injections since forever, so nothing stops this extending to git.
prepend 5y ago
I don’t consider that a reasonable risk. And even if it was, then I don’t care for repos I explicitly clone without using encryption. There’s a large set of “I don’t care” style projects where I’m just looking to grab a copy. So even if my ISP (or some nefarious jerk on the same WiFi) could MITM, I don’t care. Plus, I’m not aware of any attacks like this because of the whole git checksum thing it’s harder than injecting into http traffic. For stuff I care about, I log in.
- eptcyka 5y ago
  I'd be interested to know what kind of a development environment do you have that allows you to download arbitrary source and don't get pwnd. If you're on Qubes, that's cool, but I think most contemporary toolchains for all contemporary languages will expose some kind of arbitrary code execution through their build tools. Which is of course a massive shame.