Hacker News Reader

Comment by prepend | Hacker News Reader

It’s great for anonymous clones of public repos where I don’t care about signing in.

I work a lot of public repos. I want anonymous reads and clones to be super easy on my users.

I don’t like forcing people to log in just to read. I don’t care about encryption as the integrity of anonymous clones isn’t something I suspect will be abused.

View on HN

I said this in my top comment but https:// also allows unauthenticated access while being encrypted, whereas git:// is unencrypted and can be MITM'd.

I understand the differences. I don’t care about MITM git protocol attacks.

You don't have to force them to log in, replace with https:// and it works anonymously as it did before

Do you like your ISP being able to inject commits into your repo clones? There's nothing wrong with using HTTPS.

I don’t consider that a reasonable risk. And even if it was, then I don’t care for repos I explicitly clone without using encryption.

There’s a large set of “I don’t care” style projects where I’m just looking to grab a copy. So even if my ISP (or some nefarious jerk on the same WiFi) could MITM, I don’t care. Plus, I’m not aware of any attacks like this because of the whole git checksum thing it’s harder than injecting into http traffic.

For stuff I care about, I log in.

I'd be interested to know what kind of a development environment do you have that allows you to download arbitrary source and don't get pwnd. If you're on Qubes, that's cool, but I think most contemporary toolchains for all contemporary languages will expose some kind of arbitrary code execution through their build tools. Which is of course a massive shame.

Do you have any documentation on this?

Raw git:// without SSH keys is unencrypted, like http. Http has had ISP injections since forever, so nothing stops this extending to git.

Reply on news.ycombinator.com