News for hackers. Stuff that matters.
Re:Improving Git protocol security on GitHub by duskwuff on Wednesday September 01, 2021 @03:01PM (#28384196)
Literally all of these things are also true of https://.
Re:Improving Git protocol security on GitHub by zerocrates on Wednesday September 01, 2021 @03:28PM (#28384511)
I really only said one thing, and I'm pretty sure it's not true of https URLs under common configurations when you've stored your credentials.

What I'm talking about is this: with a git:// URL, if you plug it into Git and that repo is private, you just get "Repository not found" immediately. With an HTTPS URL, if you're routinely using HTTPS for Git, you probably have credentials saved and you might miss that something's not publicly accessible which should be.

Further, if you do have some problem like this then the issue's arguably less clear, as the behavior of a private or simply nonexistent HTTPS repo URL for users without saved credentials is to prompt for login, which can be confusing, making a user think they need a Github account or that there's some problem with theirs.

Like I said though, it's not really a big deal.

Re:Improving Git protocol security on GitHub by codys on Wednesday September 01, 2021 @03:17PM (#28384391)
https supports having credentials provided by various providers (and `.netrc`, for example). Which means when using https you don't know you're getting the anonymous user experience (because it's likely using credentials from other sources)