On Tue, Nov 14, 2017 at 1:33 PM, Tobin C. Harding <me@xxxxxxxx> wrote: > > Linus do you care what protocol? I'm patching Documentation and since > the point is creating pull requests for you 'some people' don't matter. I actually tend to prefer the regular git:// protocol and signed tags. It's true that https should have the proper certificate and perhaps help with DNS spoofing, but I'm not convinced that git won't just accept self-signed random certs, and I basically don't think we should trust that. In contrast, using ssh I would actually trust, but it's not convenient and involves people sending things that aren't necessarily publicly available. So instead, I prefer just using git:// and not trying to fool people into thinking the protocol is secure - the security should come from the signed tag. And then people can do this: [url "ssh://git@xxxxxxxxxxxxxxxxxxx"] insteadOf = https://git.kernel.org insteadOf = http://git.kernel.org insteadOf = git://git.kernel.org which makes git.kernel.org addresses use ssh, and avoid the whole possible DNS spoofing problem. That said, I actually would prefer even kernel.org repositories to just send pull requests with signed tags, despite the protocol itself being secure for that (and only that). Other hosts I will simply not trust without it because I can't do the above. Side note: there's an unrelated advantage of using "git://" over "https://";. It means that people who do automation see that it's a git repo. It also means, for example, that people that highlight https:// URL's and perhaps use them for spam marking hopefully don't do that with git:// format. Linus -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html