Subnostr

Replying to

Hazey

NEVERMIND, just no more unencrypted cloning which is good. They are not requiring authentication

Nice and Kind Vic 2y ago

i didnt even know they supported unencrypted cloning

Reply to this note

Please Login to reply.

Discussion

Hazey 2y ago

The raw git protocol is unencrypted. It's fine for in-house repos but not a good idea for the open internet. Anything unencrypted is subject to snooping, alteration, and man-in-the-middle attacks.

mleku 2y ago

If the repo's commits are signed, that closes the MITM attack/alteration vectors, and snooping too, at least learning what state is being copied in by a pull command.

Hazey 2y ago

True! But I don't think the percentage of repo's actually using signed commits is very high