Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> writes: >> I'm not buying the security argument. If you want something kept hidden >> get it out of the public db. If I know the sha of the hidden object >> can't I just add a head for it and git-deamon will happily send it and >> the chain up to it to me? > > That's a particularly idiotic statement. > > If you know the SHA1, there can *by*definition* not be any hidden objects. > The SHA1 depends on the object chain. I think what we have is even stronger --- upload-pack does not allow asking for an arbitrary commit. The requesting fetch-pack side needs to pick from what are offerred, and upload-pack makes sure of that. - To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
