Date: Mon, 25 Mar 2019 20:17:26 -0500 From: "A. Wilcox" <awilfox@...lielinux.org> To: musl@...ts.openwall.com Subject: Re: Supporting git access via smart HTTPS protocol for musl-libc On 03/25/19 20:09, vlse wrote: > Hello, > > Would musl-libc support git access via smart HTTPS protocol. > As git man page says as well as stackoverflow site that using git protocol > is fine for lan operations. > But for internet git access, either ssh or https smart protocol use > is necessary to prevent man in the middle attack. This is more an argument for signing commits so that they are cryptographically provable. HTTPS is trivial to MITM, especially for the kind of actors that would care enough to MITM musl at all. Threat models, people. > Please consider giving secure git access. Also smart http/s protocol > is way better than dumb protocol. It avoids downloading too much data > again and also shows progress and stats. There is absolutely no difference in transmitted data between the Git protocol and the HTTP Git transport, other than the useless overhead of HTTP messages, which actually skews favour towards the Git protocol. Also, the Git protocol is in my experience much much faster. The Git transport definitely can show progress and stats, the same as the HTTP transport: awilcox on gwyn [pts/18 Mon 25 20:13] ~: git clone git://git.musl-libc.org/musl Cloning into 'musl'... remote: Counting objects: 31396, done. remote: Compressing objects: 100% (12589/12589), done. remote: Total 31396 (delta 22605), reused 25698 (delta 18440) Receiving objects: 100% (31396/31396), 4.77 MiB | 3.17 MiB/s, done. Resolving deltas: 100% (22605/22605), done. (It did show the progress as it was downloading, but since I am on a fairly fast link, I couldn't copy it.) Personally I would be okay with musl offering an HTTP(S) transport as an option, but please do not take away the Git transport. It is much faster in my experience. Every second wasted on stupid HTTP traffic is a second of my life I can't get back. --arw -- A. Wilcox (awilfox) Project Lead, Adélie Linux https://www.adelielinux.org Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.