Hi Junio, On Mon, 25 Apr 2016, Junio C Hamano wrote: > Johannes Schindelin <johannes.schindelin@xxxxxx> writes: > > > To make communication for `git fetch`, `git ls-remote` and friends > > extra secure, we introduce a way to send custom HTTP headers with all > > requests. > > I think an ability to send custom headers may be a good addition and > have no problem with it, but I tend to agree with Shawn that its log > message that advertises it as if it has anything to do with security is > probably a bad idea in both ways (i.e. it isn't very secure, and the > usefulness of the feature is not limited to security). You know, it never occurred to me that anybody could even *think* that I was talking about the security of the client setup. You see, it is much easier to read $HOME/.netrc than /proc/, especially if you are looking outside of Linux, where the proc filesystem does not even exist. And it is almost as easy to query the credential helper for a plain text password as looking at $HOME/.netrc. So I took it for granted that everybody knows that they have to keep their own computer safe. Instead, I was thinking of server side security (with the clear expectation that the users will keep their client setups secure). I will rephrase the commit message to describe the actual use case I have here: build agents need temporary access to private repositories, and I'd like to do that via sort of One-Time-Passwords, sent as additional HTTP headers (via HTTPS, I should not need to point out, but now feel I have to spell out). > > Published-As: https://github.com/dscho/git/releases/tag/extra-http-headers-v1 > > Move this after "---". Whoops. That is what I intended, but overlooked. Will fix. > This obviously needs documentation updates and tests, no? Documentation, yes. I have that already, but somehow it slipped out of the patch. Testing the headers? I dunno, do we have tests for that already? I thought we did not: it requires an HTTP server (so that the headers are actually sent) that we can force to check the header... So I see we have some tests that use Apache, and one that uses our own http-backend. But is there already anything that logs HTTP requests? I did not think so, please correct me if I am wrong. Ciao, Dscho -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html