News for hackers. Stuff that matters.
Re:Improving Git protocol security on GitHub by zerocrates on Wednesday September 01, 2021 @02:19PM (#28383670)
I kind of liked having git:// as the option where no authentication was possible. Oh well.
Re:Improving Git protocol security on GitHub by psanford on Wednesday September 01, 2021 @02:28PM (#28383793)
You can still use https:// for unauthenticated access to public repos.
Re:Improving Git protocol security on GitHub by zerocrates on Wednesday September 01, 2021 @02:37PM (#28383911)
I know, but it's just, with git:// you know you're getting the "anonymous user" experience, so when things work for instructions or submodules or whatever you know it's not just because of your own saved credentials. If your repo is accidentally private, a git:// URL is just going to give you an error right away.

Not a big deal but just something that to my knowledge you won't be able to do going forward.

Re:Improving Git protocol security on GitHub by LukeShu on Wednesday September 01, 2021 @03:02PM (#28384212)
Kinda, but you could already have "saved credentials" for git:// URLs by having something like this in your ~/.config/git/config:

    [url "[email protected]:foo/bar"]
        insteadOf = git://github.com/foo/bar
Re:Improving Git protocol security on GitHub by zerocrates on Wednesday September 01, 2021 @03:31PM (#28384555)
Huh, I was unaware of that. But then again so are most people, I'm sure.

It's akin using HostName in an ssh config file, though with what I'd consider to be a kind of odd reversed directionality to how you define it (and obviously letting you protocol-jump like this).

Re:Improving Git protocol security on GitHub by duskwuff on Wednesday September 01, 2021 @03:01PM (#28384196)
Literally all of these things are also true of https://.
Re:Improving Git protocol security on GitHub by zerocrates on Wednesday September 01, 2021 @03:28PM (#28384511)
I really only said one thing, and I'm pretty sure it's not true of https URLs under common configurations when you've stored your credentials.

What I'm talking about is this: with a git:// URL, if you plug it into Git and that repo is private, you just get "Repository not found" immediately. With an HTTPS URL, if you're routinely using HTTPS for Git, you probably have credentials saved and you might miss that something's not publicly accessible which should be.

Further, if you do have some problem like this then the issue's arguably less clear, as the behavior of a private or simply nonexistent HTTPS repo URL for users without saved credentials is to prompt for login, which can be confusing, making a user think they need a Github account or that there's some problem with theirs.

Like I said though, it's not really a big deal.

Re:Improving Git protocol security on GitHub by codys on Wednesday September 01, 2021 @03:17PM (#28384391)
https supports having credentials provided by various providers (and `.netrc`, for example). Which means when using https you don't know you're getting the anonymous user experience (because it's likely using credentials from other sources)
Re:Improving Git protocol security on GitHub by jessikat on Wednesday September 01, 2021 @09:03PM (#28387525)
I use https solely for fetch, and ssh for push. Then the only credentials are the ssh keys. Does mean I need to edit the remote after fetching, but I'm pretty happy with that.
Re:Improving Git protocol security on GitHub by bluefox on Wednesday September 01, 2021 @04:16PM (#28385032)
It will invalidate all existing git:// links to repositories hosted on Microsoft GitHub, in the name of "security".