3 ms·
Do you like your ISP being able to inject commits into your repo clones? There's nothing wrong with using HTTPS.
by eptcyka 5y ago
Do you like your ISP being able to inject commits into your repo clones? There's nothing wrong with using HTTPS.
- quinnjh 5y agoDo you have any documentation on this?
- snovv_crash 5y agoRaw git:// without SSH keys is unencrypted, like http. Http has had ISP injections since forever, so nothing stops this extending to git.
- prepend 5y agoI don’t consider that a reasonable risk. And even if it was, then I don’t care for repos I explicitly clone without using encryption. There’s a large set of “I don’t care” style projects where I’m just looking to grab a copy. So even if my ISP (or some nefarious jerk on the same WiFi) could MITM, I don’t care. Plus, I’m not aware of any attacks like this because of the whole git checksum thing it’s harder than injecting into http traffic. For stuff I care about, I log in.
- eptcyka 5y agoI'd be interested to know what kind of a development environment do you have that allows you to download arbitrary source and don't get pwnd. If you're on Qubes, that's cool, but I think most contemporary toolchains for all contemporary languages will expose some kind of arbitrary code execution through their build tools. Which is of course a massive shame.