Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: GitHub no longer supporting unauthenticated `git://`

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 144 posts

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#3

Post by vermilingua »

judge2020 wrote: post #2

git:// is not just unauthenticated, but unencrypted on the wire. They want you to use https:// for unauthenticated clones to at least prevent MITMs.

Doesn’t git:// transport use SSH? How is SSH possibly unencrypted on the wire?

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#4

Post by otherjason »

vermilingua wrote: post #3
judge2020 wrote: post #2

git:// is not just unauthenticated, but unencrypted on the wire. They want you to use https:// for unauthenticated clones to at least prevent MITMs.

Doesn’t git:// transport use SSH? How is SSH possibly unencrypted on the wire?

No. From https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protoco...:

> Finally, we have the Git protocol. This is a special daemon that comes packaged with Git; it listens on a dedicated port (9418) that provides a service similar to the SSH protocol, but with absolutely no authentication. In order for a repository to be served over the Git protocol, you must create a git-daemon-export-ok file — the daemon won’t serve a repository without that file in it — but, other than that, there is no security. Either the Git repository is available for everyone to clone, or it isn’t. This means that there is generally no pushing over this protocol. You can enable push access but, given the lack of authentication, anyone on the internet who finds your project’s URL could push to that project. Suffice it to say that this is rare.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#5

Post by tialaramex »

judge2020 wrote: post #2

git:// is not just unauthenticated, but unencrypted on the wire. They want you to use https:// for unauthenticated clones to at least prevent MITMs.

And in consequence although many people will experience it no longer working, it might still "work" for you (or it might never have "worked") since anybody who is between you and GitHub can decide what happens instead.

If you've insisted on building something that insists on using git:// this way, you can proxy it to the safer supported system seamlessly, since you had no way to know before it was correct and you'll have no way to know if the proxy worked either. Somebody might already make a tool to do that, if not you could roll your own.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#8

Post by idealmedtech »

andrew_ wrote: post #6

Just got bit by that this morning. For anyone updating contributor forks submitted in Pull Requests, use `git@github: / .git`. I don't know what black magic github had going on prior, but I was always able to just use `git://`

I believe you meant git@github.com

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#9

Post by rgoulter »

vermilingua wrote: post #3
judge2020 wrote: post #2

git:// is not just unauthenticated, but unencrypted on the wire. They want you to use https:// for unauthenticated clones to at least prevent MITMs.

Doesn’t git:// transport use SSH? How is SSH possibly unencrypted on the wire?

I think you're thinking of the URLs like git@github.com:/.git
Post reply on HN