On Thu, Dec 20, 2012 at 04:51:37PM +0100, Michael Haggerty wrote: > > The problem seems to be that people are giving bad advice to tell people > > to post "git config -l" output without looking at. Maybe we could help > > them with a "git config --share-config" option that dumps all config, > > but sanitizes the output. It would need to have a list of sensitive keys > > (which does not exist yet), and would need to not just mark up things > > like smtppass, but would also need to pull credential information out of > > remote.*.url strings. And maybe more (I haven't thought too long on it). > > I think the problem is yet another step earlier: why do we build tools > that encourage people to store passwords in plaintext in a configuration > file that is by default world-readable? Agreed. Most of it is hysterical raisins. We did not have any portable secure storage for a long time. These days we have the credential helper subsystem, which send-email can and should be using. -Peff -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html