Re:Bill Gates: "I'm literally losing sleep over Java"
by kragen on Thursday January 05, 2023 @10:22AM
(#34260870)
i wasn't talking about git:// urls and i think that removing them was probably a good idea, for the reasons you describe, but also because they didn't have any way to stymie mitm attacks
but it seems like my original comment was incorrect in a couple of different important ways, and i appreciate people having pointed that out
Long ago they used to push SSH as the "right" way to pull repositories (I still almost exclusively use SSH), but their change to recommending HTTPS instead by default is by now quite old: it's been the case for many years.
Other related things have changed more recently: Github doesn't allow git:// urls anymore (but HTTPS still allows anonymous checkouts), and when doing authenticated HTTPS, you now need to provide a token instead of your password.
The git:// protocol, to my recollection, doesn't support authentication at all. If you've ever been able to push to git:// URLs on Github, it's news to me.