4 ms·
The heuristic for Github though is that the vast majority of people visiting a repository page who aren't logged in to Github on that browser don't have an auth
by zerocrates 4y ago
The heuristic for Github though is that the vast majority of people visiting a repository page who aren't logged in to Github on that browser don't have an authorized private key. It makes complete sense to present only options for anonymous checkouts to anonymous users.
Long ago they used to push SSH as the "right" way to pull repositories (I still almost exclusively use SSH), but their change to recommending HTTPS instead by default is by now quite old: it's been the case for many years.
Other related things have changed more recently: Github doesn't allow git:// urls anymore (but HTTPS still allows anonymous checkouts), and when doing authenticated HTTPS, you now need to provide a token instead of your password.
The git:// protocol, to my recollection, doesn't support authentication at all. If you've ever been able to push to git:// URLs on Github, it's news to me.
- kragen 4y agoi wasn't talking about git:// urls and i think that removing them was probably a good idea, for the reasons you describe, but also because they didn't have any way to stymie mitm attacks but it seems like my original comment was incorrect in a couple of different important ways, and i appreciate people having pointed that out