Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: GitHub no longer supporting unauthenticated `git://`

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 144 posts

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#51

Post by TAKEMYMONEY »

stblack wrote: post #29
Invictus0 wrote: post #25

Earlier quoted context omitted.

It's really not that hard. Install the GitHub CLI and it gives you a simple setup wizard on first run. The GitHub page for the CLI also has clear and simple instructions on how to install it for any OS.

Hmmm. Maybe you haven't done that from scratch recently? The deprecation of passwords for tokens is a fairly recent thing. Try it with a fresh laptop: nothing pre-configured. Show someone new how you set up, from scratch. You're gonna be shocked.

The Github team has done a great job on the docs for this process. It's one of the few places I can tell a jr dev to RTFM and send them a link to the Github docs, suddenly they're an expert in SSH and up and running in 10 minutes.

A couple years ago it was harder, but I've done this from scratch on my machines and others' several times over the last few months and it's always easy.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#52

Post by falcor84 »

u801e wrote: post #50
asveikau wrote: post #37

Earlier quoted context omitted.

I've used git without github quite a bit. I don't know anyone who would advocate using the raw git: protocol without ssh. Setting up an ssh key is not a conspiracy to make it more difficult. Using ssh is simply how it's done. I'm not a fan of the github app or github cli, I prefer the standard tools. However, calling this "embrace, extend, extinguish" is weird.

> I don't know anyone who would advocate using the raw git: protocol without ssh. Setting up an ssh key is not a conspiracy to make it more difficult. Using ssh is simply how it's done. But it does require having an account or public key on the server. https does not require having an account, but the http transport protocol is less efficient compared to the native git protocol. If git supported a protocol like gits…

> But it does require having an account or public key on the server.

It's a bit of a hassle, but I suppose you could always create a public read-only account with a 'private' ssh key made available in the readme.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#53

Post by mockery »

vtbassmatt wrote: post #14

Today we're in a 24-hour brownout period to help folks find places they might have forgotten which rely on unencrypted git:// protocol. The date where this will go away permanently is still March 15, 2022. (I'm the product manager for Git Systems at GitHub.)

It seems like the brownout should be publicized on the front page of github.com - or at least githubstatus.com ?

(Although I'm not an active git/github user, so maybe there's an even more more obvious place a naive user having issues would go to figure out what their problem is. Hopefully there's a helpful commandline error explaining the situation.)

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#54

Post by ocdtrekkie »

vtbassmatt wrote: post #20
arilotter wrote: post #19

Earlier quoted context omitted.

Our CI system broke as a result - I really like this "brownout" idea to help us find it before it turns off for good, but a 24-hour period for us to be broken or scramble to fix is kind of a PITA. I imagine it would be much more technical effort, but a way for us to opt certain repos out of a brownout would be really nice, so that once it happens, we could easily disable the brownout for our repo & schedule working o…

Noted! As you surmise, that's a MUCH bigger lift, but it's worth considering.

An interesting additional benefit here, is that rather than a brownout, you could just have a "soft cutover", where people can reenable the old protocols for two months. There's good reason for this:

- People who aren't using the old methods can turn them off now and leave them off, benefiting from the new security change sooner.

- People who need to fix something can temporarily repair their workflow at the time of their choosing.

- People who need more than 24 hours to fix their workflow can re-disable the old methods to test that they are now good, at a time of their leisure, between today and March.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#55

Post by Firehawke »

burnished wrote: post #44
Invictus0 wrote: post #31

Earlier quoted context omitted.

I have setup github several times in the last 3 days on fresh Linux installs. It is very easy.

Hey, I keep bouncing between mac and windows, where/how do you store credentials/tokens? I feel like I've got passwords now that I can't memorize and have to save as text somewhere. I'm putting sensitive stuff in a secrets folder with a corresponding gitignore entry, but I feel like there has got to be some well understood way to handle this?

Yubikey is probably the sanest cross-platform solution. Assuming you're using an updated beyond Microsoft's default version, which you'll need to get from https://github.com/PowerShell/Win32-OpenSSH/releases to have support for USB keys, of course. Hopefully MS will update their included version at some point soon.

From there, it's as simple as telling the .ssh/config file to use the key from your Yubikey and you can use the same config file on any machine you have OpenSSH.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#56

Post by progmetaldev »

stblack wrote: post #28
tialaramex wrote: post #15

Earlier quoted context omitted.

Well, I mean, if you're learning from Rust note that cargo just automatically makes new projects a git repository if that's possible, in the same way it defaults to your new project's code being a trivial implementation of "Hello, world." so that it will build and run before you write any code, and it defaults to providing you a working HTML documentation build and unit test framework. Plus of course it's access to t…

Sorry I may have been unclear? I'm referring to what's required to make a local git repo interoperate with Github. Either via the command line, or with an editor plugin, or an app. Including the Github desktop app. That's a nightmare.

It seems like if you can get a new user used to using and understanding Git itself, Github shouldn't be that difficult to figure out, no?

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#57

Post by Wowfunhappy »

alophawen wrote: post #48
stblack wrote: post #28

Earlier quoted context omitted.

Sorry I may have been unclear? I'm referring to what's required to make a local git repo interoperate with Github. Either via the command line, or with an editor plugin, or an app. Including the Github desktop app. That's a nightmare.

1. go to github and create a new repository ( https://github.com/new ) 2. read the text in front of you: git remote add origin git@github.com:yourusername/repositoryname.git git branch -M main git push -u origin main

How are you authenticating with github?

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#58

Post by vtbassmatt »

burnished wrote: post #44
Invictus0 wrote: post #31

Earlier quoted context omitted.

I have setup github several times in the last 3 days on fresh Linux installs. It is very easy.

Hey, I keep bouncing between mac and windows, where/how do you store credentials/tokens? I feel like I've got passwords now that I can't memorize and have to save as text somewhere. I'm putting sensitive stuff in a secrets folder with a corresponding gitignore entry, but I feel like there has got to be some well understood way to handle this?

https://github.com/GitCredentialManager/git-credential-manag... (comes bundled with Git for Windows; you can install it for macOS). SSH is also an option on both platforms, though historically a bit harder on Windows than elsewhere.

(Disclosure, two of the core maintainers of GCM are GitHub employees, though GCM's goal is to work well with any Git host.)

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#59

Post by progmetaldev »

bin_bash wrote: post #18
otherjason wrote: post #4

Earlier quoted context omitted.

No. From https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protoco... : > Finally, we have the Git protocol. This is a special daemon that comes packaged with Git; it listens on a dedicated port (9418) that provides a service similar to the SSH protocol, but with absolutely no authentication. In order for a repository to be served over the Git protocol, you must create a git-daemon-export-ok file — the daemon won’…

I was also under the incorrect impression that git:// was just an alias for ssh. It's amazing how long you can use something and still not understand how it works.

Don't worry, when I first started reading I was under the same impression. git:// and git@ are so close to each other, it was easy to misunderstand.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#60

Post by prepend »

asveikau wrote: post #37
traverseda wrote: post #16

It seems like mostly the effects of all these auth changes are twofold * ~~Force~~ Encourage people to have github accounts * Make using plain git more difficult (auth tokens, deprecating passwords, etc) while encouraging people to use the github cli tool Given microsoft's history of "embrace, extend, extinguish" I have a hard time seeing these changes as anything other than an attack on git as an open ecosystem.

I've used git without github quite a bit. I don't know anyone who would advocate using the raw git: protocol without ssh. Setting up an ssh key is not a conspiracy to make it more difficult. Using ssh is simply how it's done. I'm not a fan of the github app or github cli, I prefer the standard tools. However, calling this "embrace, extend, extinguish" is weird.

It’s great for anonymous clones of public repos where I don’t care about signing in.

I work a lot of public repos. I want anonymous reads and clones to be super easy on my users.

I don’t like forcing people to log in just to read. I don’t care about encryption as the integrity of anonymous clones isn’t something I suspect will be abused.

Post reply on HN