From: "brian m. carlson" <sandals@crustytoothpaste•net>
To: Junio C Hamano <gitster@pobox•com>
Cc: M Hickford <mirth.hickford@gmail•com>,
git@vger•kernel.org, stolee@gmail•com, avarab@gmail•com,
Johannes.Schindelin@gmx•de, peff@peff•net
Subject: Re: Changing transfer.credentialsInUrl to default to "warn"
Date: Mon, 13 Jan 2025 21:54:58 +0000 [thread overview]
Message-ID: <Z4WLsmq4rPEMnUXK@tapette.crustytoothpaste.net> (raw)
In-Reply-To: <xmqq1px6br7p.fsf@gitster.g>
[-- Attachment #1: Type: text/plain, Size: 1265 bytes --]
On 2025-01-13 at 16:42:34, Junio C Hamano wrote:
> M Hickford <mirth.hickford@gmail•com> writes:
>
> > In order to nudge users towards more secure practices (namely,
> > using a credential helper), would anyone else be in favour of
> > changing transfer.credentialsInUrl to default to "warn"?
>
> I personally do not have a problem with the proposal, but it is
> curious that it is documented as inspecting only .URL and .pushURL
> is not checked. So, in addition to "once we start warning by
> default, we'd need an advice message to tell the users how to turn
> it off" Derrick says in the commit log message, we would probably
> want to see if we should/can cover .pushURL and need necessary updates
> before it happens.
I agree.
It's not clear to me from the documentation if this only warns if
there's a password in the URL or also if there's just a username. (To
me, the word "credentials" doesn't seem to explain that very well.) The
former I think is fine, the latter is not. Looking at the code, it
appears it is the former, so that's good.
Perhaps we should also clarify the documentation so that users can make
an educated decision. I'll send a patch.
--
brian m. carlson (they/them or he/him)
Toronto, Ontario, CA
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 263 bytes --]
prev parent reply other threads:[~2025-01-13 21:55 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-11 7:15 Changing transfer.credentialsInUrl to default to "warn" M Hickford
2025-01-13 16:42 ` Junio C Hamano
2025-01-13 21:53 ` Johannes Schindelin
2025-01-13 22:27 ` Junio C Hamano
2025-01-13 21:54 ` brian m. carlson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z4WLsmq4rPEMnUXK@tapette.crustytoothpaste.net \
--to=sandals@crustytoothpaste$(echo .)net \
--cc=Johannes.Schindelin@gmx$(echo .)de \
--cc=avarab@gmail$(echo .)com \
--cc=git@vger$(echo .)kernel.org \
--cc=gitster@pobox$(echo .)com \
--cc=mirth.hickford@gmail$(echo .)com \
--cc=peff@peff$(echo .)net \
--cc=stolee@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox