Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: GitHub no longer supporting unauthenticated `git://`

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#131

Post by eptcyka »

prepend wrote: post #126
eptcyka wrote: post #74

Earlier quoted context omitted.

Do you like your ISP being able to inject commits into your repo clones? There's nothing wrong with using HTTPS.

I don’t consider that a reasonable risk. And even if it was, then I don’t care for repos I explicitly clone without using encryption. There’s a large set of “I don’t care” style projects where I’m just looking to grab a copy. So even if my ISP (or some nefarious jerk on the same WiFi) could MITM, I don’t care. Plus, I’m not aware of any attacks like this because of the whole git checksum thing it’s harder than inject…

I'd be interested to know what kind of a development environment do you have that allows you to download arbitrary source and don't get pwnd. If you're on Qubes, that's cool, but I think most contemporary toolchains for all contemporary languages will expose some kind of arbitrary code execution through their build tools. Which is of course a massive shame.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#133

Post by DarylZero »

ziml77 wrote: post #103
bin_bash wrote: post #18

Earlier quoted context omitted.

I was also under the incorrect impression that git:// was just an alias for ssh. It's amazing how long you can use something and still not understand how it works.

I thought the same thing! I didn't expect git to have a way to communicate unauthenticated and unencrypted built-in.

It's also possible to simply set the `$GIT_SSH` environment variable or `core.sshCommand` config option to an unencrypted shell like `rsh`

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#134

Post by superkuh »

purkka wrote: post #108
superkuh wrote: post #107

Earlier quoted context omitted.

Like most crimes, the biggest and most common dangers come from the people/software you already know. It's going to be a company's profit incentive or a lone dev's hissy fit expressed through softare you implicitly trust that gets you. Unencrypted internet transfers have worked and will continue to work for a very long time with very few problems for the vast majority of people. Requiring encryption might be okay, bu…

If you're using GitHub, you've already centralized. git:// support is not being removed from Git or self-hosted repos of any kind.

https://indieweb.org/POSSE

> POSSE is an abbreviation for Publish (on your) Own Site, Syndicate Elsewhere, the practice of posting content on your own site first, then publishing copies or sharing links to third parties (like social media silos) with original post links to provide viewers a path to directly interacting with your content.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#135

Post by desdiv »

benburleson wrote: post #130

Was there some notification of this change sent directly to all github users? I checked email and didn't find any references to the change from github. Is there some other automated system to become aware of changes like this, other than stumbling upon a HN post? Edit: Also looking here https://github.blog/changelog/ I don't see a related notification. I'm probably missing it though because there seems to be a lot of…

> Was there some notification of this change sent directly to all github users? I checked email and didn't find any references to the change from github.

Same here. No notification email as far as I can find. (Through this might depend on your notification settings? I have mine set to the minimal.)

>Is there some other automated system to become aware of changes like this, other than stumbling upon a HN post?

Github offer the web changelog, their RSS changelog, and the Twitter account @GHchangelog. These three all relay the same information, and ironically all three missed announcing this important change. Instead they posted a blog post[0] which was not linked at all by the changelogs.

So to answer your question: you need to follow all updates on both https://github.blog/changelog AND https://github.blog.

[0] https://github.blog/2021-09-01-improving-git-protocol-securi...

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#136

Post by rgoulter »

burnished wrote: post #128
_g5q8 wrote: post #89

Earlier quoted context omitted.

Credentials/tokens go in environment variables. For development, the convention is to make a `.env` file that's in `.gitignore` and load it into your environment variables. In deployed contexts, you often have a system to do this for you.

What sort of tools read .env files/what do I need to know to comfortably set and read environment variables in PowerShell or Bash? Do you just keep the token there in plain text in the .env file? If you have multiple work stations, do you have a method to keep your secrets synched? Sorry about all the questions! I appreciate any insight you might have on this though.

One way I see `.env` files used is with NodeJS webservers which will read in the .env file.

But more generally, in shell usage: On Unix machines: direnv https://direnv.net/ (It doesn't support powershell; but I see there are scripts for powershell inspired by this). -- Just be very certain these won't get committed into the repo if you're going to put secrets in them.

I think it's preferable to have different secrets for different machines. (e.g. different SSH keys, or different AWS IAM users - which can each assume a shared role if that's easier to manage).

If you want to sync secrets, one easy way is to use a password database, and then use Dropbox whatever equivalent solution. Another way would be to use e.g. PGP keys. (The public key of a PGP key can be shared between machines, and can be used to encrypt contents for that machine).

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#137

Post by Too »

humanwhosits wrote: post #46
arilotter wrote: post #19

Earlier quoted context omitted.

Our CI system broke as a result - I really like this "brownout" idea to help us find it before it turns off for good, but a 24-hour period for us to be broken or scramble to fix is kind of a PITA. I imagine it would be much more technical effort, but a way for us to opt certain repos out of a brownout would be really nice, so that once it happens, we could easily disable the brownout for our repo & schedule working o…

Brownouts make me lose confidence in the product, simply because it manifests as a failure that needs to be debugged at unknown cost

What do you suggest instead?

This was announced long ago. Though have to admit I didn’t see it back then myself.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#138

Post by quickthrower2 »

rurp wrote: post #113
BossingAround wrote: post #79

Earlier quoted context omitted.

What is the difficult part of setting up git? 1) Setup ssh keys 2) Create GitHub account 3) Push public key to GitHub 4) Setup username/email 5) Setup org. permissions on repos Done..?

> What is the difficult part of setting up git? For an experienced developer, nothing. But for a beginner, two or three of those steps will be very confusing.

There is a github client you can download, I wonder if that does this all for you? If not it should.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#139

Post by SahAssar »

quickthrower2 wrote: post #138
rurp wrote: post #113

Earlier quoted context omitted.

> What is the difficult part of setting up git? For an experienced developer, nothing. But for a beginner, two or three of those steps will be very confusing.

There is a github client you can download, I wonder if that does this all for you? If not it should.

IIRC the github client (by default) uses HTTP auth, not SSH auth. It works for using the client, but not if you use other tooling that needs repo access (like pushing from your IDE).

At least that was the case with github for windows last I used it a few years ago.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#140

Post by benburleson »

vtbassmatt wrote: post #14

Today we're in a 24-hour brownout period to help folks find places they might have forgotten which rely on unencrypted git:// protocol. The date where this will go away permanently is still March 15, 2022. (I'm the product manager for Git Systems at GitHub.)

I'm reposting another comment I made here for visibility with you specifically:

Other than the blog post that doesn't appear in the changelog RSS, how were we supposed to be made aware of this breaking change?

Post reply on HN