Hacker News Reader

Do you like your ISP being able to inject commits into your repo clones? There's nothing wrong with using HTTPS.

I don’t consider that a reasonable risk. And even if it was, then I don’t care for repos I explicitly clone without using encryption.

There’s a large set of “I don’t care” style projects where I’m just looking to grab a copy. So even if my ISP (or some nefarious jerk on the same WiFi) could MITM, I don’t care. Plus, I’m not aware of any attacks like this because of the whole git checksum thing it’s harder than injecting into http traffic.

For stuff I care about, I log in.

I'd be interested to know what kind of a development environment do you have that allows you to download arbitrary source and don't get pwnd. If you're on Qubes, that's cool, but I think most contemporary toolchains for all contemporary languages will expose some kind of arbitrary code execution through their build tools. Which is of course a massive shame.

Do you have any documentation on this?

Raw git:// without SSH keys is unencrypted, like http. Http has had ISP injections since forever, so nothing stops this extending to git.

Reply on news.ycombinator.com