4 ms·

I also have a hard time understanding why would people use https to clone a repo when ssh is there and so much more convenient…

maratc 2y ago
Also, an existing repo that has been cloned over https can be converted to use ssh: ~ $ git remote -v origin https://github.com/mycompany/myproject.git (fetch) origin https://github.com/mycompany/myproject.git (push) ~ $ git remote remove origin ~ $ git remote add origin git@github.com:mycompany/myproject.git ~ $ git remote -v origin git@github.com:mycompany/myproject.git (fetch) origin git@github.com:mycompany/myproject.git (push)
- frizlab 2y ago
  Or git remote set-url origin git@github.com:... Or using URL replacements in git config.
  - seodisparate 2y ago
    Or using .ssh/config since entries in there act like hostnames: # ~/.ssh/config Host github_ssh HostName github.com User git IdentityFile ~/.ssh/my_github_key > git remote add github github_ssh:Username/RepoName.git This has worked reliably for me for quite a while now.
    - fisian 2y ago
      However, this doesn't work well with git submodules, because then everyone cloning the repo must recreate this config. (Just something to be aware of.)
      - 3np 2y ago
        It works fine if coupled with URL replacement. The custom hostname will be replaced transparantly for you and won't need to make it into gitmodules. # ~/.config/git/config # Only for single user/org [url "git@github_ssh:foo"] insteadOf = "git@github.com:foo" # all the things [url "git@github_ssh"] insteadOf = "git@github.com" Similar pattern if you want to force-use ssh instead of https or vice-versa.
hamandcheese 2y ago
You can't clone a public repo over SSH without having authenticated keys set up. Somewhat annoying on servers that you forgot/don't want to use agent forwarding on.
- ninjin 2y ago
  You can set up anonymous SSH access. It is just that for some reason the big "hubs" do not do so. See for example the instructions that come with gotsh(1): https://www.gameoftrees.org/gotsh.1.html https://www.gameoftrees.org/gotsh.1.html Obviously not a good idea for repositories that you want to keep private. But it is odd to me how rare it is for public repositories.
- JackSlateur 2y ago
  Why ? Openbar readonly ssh servers exists. Also, cloning private repo via http is a pain, when MFA is involved
Ferret7446 2y ago
HTTP has many advantages (and SSH has disadvantages) as detailed in https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protoco.... Briefly, HTTP is more flexible. For authentication, you could use passwords or OAuth.
- frizlab 2y ago
  From your link, literally, both HTTPS and SSH have pros and cons! You make it look like SSH only has cons and HTTPS only has pros; that’s borderline dishonest.
akdor1154 2y ago
I also used to think this, then I realised https has far better performance, particularly for high latency connections. A big repo clone from Github to here in Australia takes about half the time over https when compared with ssh. I'm not sure if github has region-located repos.
- bin_bash 2y ago
  does it? I've used both quite a bit and ssh certainly "feels" faster to me (with multiplexing)
- MaxBarraclough 2y ago
  It's possible that's an issue with GitHub, rather than anything inherent to the protocols. Somewhat related: SourceHut blog post on them optimising Git operations over SSH: https://sourcehut.org/blog/2019-11-22-what-happens-on-git-push/ https://sourcehut.org/blog/2019-11-22-what-happens-on-git-pu...
szszrk 2y ago
In corporate networks having direct access to public hosts (or even internal ones) with anything other than https is a challenge.
MaxBarraclough 2y ago
I'd generally recommend HTTPS, simply because most developers cannot be trusted to manually verify SSH public keys/fingerprints. Most will blindly approve whatever fingerprint they are shown, opening the door to man-in-the-middle attacks. This isn't just an issue during initial set-up. If the Git host rotates their keys, it will need the client to accept the new keys. If your developers are sloppy and unthinkingly approve the new fingerprint, that means they're vulnerable to a MitM attack at any moment; presumably they'd unthinkingly approve an attacker's fingerprint too. With HTTPS, you inherit the web's CA model, and it's pretty much secure-by-default.
- mariocesar 2y ago
  Respectfully, it seems that your actual problem is that you work with developers who can't be trusted to manually verify SSH public keys/fingerprints, not that SSH is complicated. Defaulting to HTTPS just because it is easier for them feels like a no-solution, but I could be generalizing. Maybe you are talking about developers in training or L1 levels.
  - dangsux 2y ago
    [flagged]
    - MaxBarraclough 2y ago
      > There is a reason github’s ui defaults to clone over ssh which is missed by you. I think you meant HTTPS here?
      - dangsux 2y ago
        [dead]
    - frizlab 2y ago
      Acknowledging I’m not a casual computer user, I personally find https being the unnecessary friction (must [learn to +] setup setting user/password for https, username/password do not work for https because 2FA, etc.). With ssh I upload my key and I’m done.
Daedren 2y ago
Plenty of places don't support Git LFS over SSH

maratc 2y ago

Also, an existing repo that has been cloned over https can be converted to use ssh: ~ $ git remote -v origin https://github.com/mycompany/myproject.git (fetch) origin https://github.com/mycompany/myproject.git (push) ~ $ git remote remove origin ~ $ git remote add origin git@github.com:mycompany/myproject.git ~ $ git remote -v origin git@github.com:mycompany/myproject.git (fetch) origin git@github.com:mycompany/myproject.git (push)

frizlab 2y ago
Or git remote set-url origin git@github.com:... Or using URL replacements in git config.
- seodisparate 2y ago
  Or using .ssh/config since entries in there act like hostnames: # ~/.ssh/config Host github_ssh HostName github.com User git IdentityFile ~/.ssh/my_github_key > git remote add github github_ssh:Username/RepoName.git This has worked reliably for me for quite a while now.
  - fisian 2y ago
    However, this doesn't work well with git submodules, because then everyone cloning the repo must recreate this config. (Just something to be aware of.)
    - 3np 2y ago
      It works fine if coupled with URL replacement. The custom hostname will be replaced transparantly for you and won't need to make it into gitmodules. # ~/.config/git/config # Only for single user/org [url "git@github_ssh:foo"] insteadOf = "git@github.com:foo" # all the things [url "git@github_ssh"] insteadOf = "git@github.com" Similar pattern if you want to force-use ssh instead of https or vice-versa.

hamandcheese 2y ago

You can't clone a public repo over SSH without having authenticated keys set up. Somewhat annoying on servers that you forgot/don't want to use agent forwarding on.

ninjin 2y ago
You can set up anonymous SSH access. It is just that for some reason the big "hubs" do not do so. See for example the instructions that come with gotsh(1): https://www.gameoftrees.org/gotsh.1.html https://www.gameoftrees.org/gotsh.1.html Obviously not a good idea for repositories that you want to keep private. But it is odd to me how rare it is for public repositories.
JackSlateur 2y ago
Why ? Openbar readonly ssh servers exists. Also, cloning private repo via http is a pain, when MFA is involved

Ferret7446 2y ago

HTTP has many advantages (and SSH has disadvantages) as detailed in https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protoco.... Briefly, HTTP is more flexible. For authentication, you could use passwords or OAuth.

frizlab 2y ago
From your link, literally, both HTTPS and SSH have pros and cons! You make it look like SSH only has cons and HTTPS only has pros; that’s borderline dishonest.

akdor1154 2y ago

I also used to think this, then I realised https has far better performance, particularly for high latency connections. A big repo clone from Github to here in Australia takes about half the time over https when compared with ssh. I'm not sure if github has region-located repos.

bin_bash 2y ago
does it? I've used both quite a bit and ssh certainly "feels" faster to me (with multiplexing)
MaxBarraclough 2y ago
It's possible that's an issue with GitHub, rather than anything inherent to the protocols. Somewhat related: SourceHut blog post on them optimising Git operations over SSH: https://sourcehut.org/blog/2019-11-22-what-happens-on-git-push/ https://sourcehut.org/blog/2019-11-22-what-happens-on-git-pu...

szszrk 2y ago

In corporate networks having direct access to public hosts (or even internal ones) with anything other than https is a challenge.

MaxBarraclough 2y ago

I'd generally recommend HTTPS, simply because most developers cannot be trusted to manually verify SSH public keys/fingerprints. Most will blindly approve whatever fingerprint they are shown, opening the door to man-in-the-middle attacks. This isn't just an issue during initial set-up. If the Git host rotates their keys, it will need the client to accept the new keys. If your developers are sloppy and unthinkingly approve the new fingerprint, that means they're vulnerable to a MitM attack at any moment; presumably they'd unthinkingly approve an attacker's fingerprint too. With HTTPS, you inherit the web's CA model, and it's pretty much secure-by-default.

mariocesar 2y ago
Respectfully, it seems that your actual problem is that you work with developers who can't be trusted to manually verify SSH public keys/fingerprints, not that SSH is complicated. Defaulting to HTTPS just because it is easier for them feels like a no-solution, but I could be generalizing. Maybe you are talking about developers in training or L1 levels.
- dangsux 2y ago
  [flagged]
  - MaxBarraclough 2y ago
    > There is a reason github’s ui defaults to clone over ssh which is missed by you. I think you meant HTTPS here?
    - dangsux 2y ago
      [dead]
  - frizlab 2y ago
    Acknowledging I’m not a casual computer user, I personally find https being the unnecessary friction (must [learn to +] setup setting user/password for https, username/password do not work for https because 2FA, etc.). With ssh I upload my key and I’m done.

Daedren 2y ago

Plenty of places don't support Git LFS over SSH