Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: GitHub no longer supporting unauthenticated `git://`

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 144 posts

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#21

Post by lewiscollard »

traverseda wrote: post #16

It seems like mostly the effects of all these auth changes are twofold * ~~Force~~ Encourage people to have github accounts * Make using plain git more difficult (auth tokens, deprecating passwords, etc) while encouraging people to use the github cli tool Given microsoft's history of "embrace, extend, extinguish" I have a hard time seeing these changes as anything other than an attack on git as an open ecosystem.

> Make using plain git more difficult

The change in question does not. It only requires that you clone over SSH or HTTPS, not over git://. I don't see why anyone would want to use the latter today.

Given how trivial it is to self-host your own Git repositories on any random Unix box, I am not worried about GitHub attempting lock-in even if they tried.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#22

Post by vtbassmatt »

traverseda wrote: post #16

It seems like mostly the effects of all these auth changes are twofold * ~~Force~~ Encourage people to have github accounts * Make using plain git more difficult (auth tokens, deprecating passwords, etc) while encouraging people to use the github cli tool Given microsoft's history of "embrace, extend, extinguish" I have a hard time seeing these changes as anything other than an attack on git as an open ecosystem.

This change doesn't force you to have a GitHub account. https:// access to public repos doesn't require authentication.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#23

Post by traverseda »

outside1234 wrote: post #17
traverseda wrote: post #16

It seems like mostly the effects of all these auth changes are twofold * ~~Force~~ Encourage people to have github accounts * Make using plain git more difficult (auth tokens, deprecating passwords, etc) while encouraging people to use the github cli tool Given microsoft's history of "embrace, extend, extinguish" I have a hard time seeing these changes as anything other than an attack on git as an open ecosystem.

Or its about preventing MITM attacks, which is a much more likely, much less tin foil explanation.

Taken alone it's pretty reasonable, but it does seem like part of a larger trend. Removing the ability to authenticate with a password using standard git seems to me like a pretty obvious attempt to force people to use the `gh` cli tool.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#25

Post by Invictus0 »

stblack wrote: post #11

Incidentally I'm onboarding someone new to git and Github. I must say, Github is now exceedingly difficult to set up. Vocalizing every step of the process, hopefully not in a hand-wavy way, it strikes me how hard this must be for unguided noobs. To some degree, this must be crushing the value of the service. If ever there was a crying need for setup wizards, configuration audit helpers, and clear error messages, this…

It's really not that hard. Install the GitHub CLI and it gives you a simple setup wizard on first run. The GitHub page for the CLI also has clear and simple instructions on how to install it for any OS.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#26

Post by mzs »

traverseda wrote: post #16

It seems like mostly the effects of all these auth changes are twofold * ~~Force~~ Encourage people to have github accounts * Make using plain git more difficult (auth tokens, deprecating passwords, etc) while encouraging people to use the github cli tool Given microsoft's history of "embrace, extend, extinguish" I have a hard time seeing these changes as anything other than an attack on git as an open ecosystem.

It really wasn't that hard, just created a key pair and added this to my ~/.ssh/config

  Host github.com
   Hostname github.com
   User git
   IdentitiesOnly yes
   IdentityFile ~/.ssh/github-id_rsa
Lots of other ways to do it as well:

https://superuser.com/questions/232373/how-to-tell-git-which...

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#27

Post by gbraad »

traverseda wrote: post #16

It seems like mostly the effects of all these auth changes are twofold * ~~Force~~ Encourage people to have github accounts * Make using plain git more difficult (auth tokens, deprecating passwords, etc) while encouraging people to use the github cli tool Given microsoft's history of "embrace, extend, extinguish" I have a hard time seeing these changes as anything other than an attack on git as an open ecosystem.

Authentication seems the essential keyword here. Even their npm registry, when configured for a public package, needs an authenticated user before you can pull. This was promised to not be needed over a year ago. We eventually gave up in this as it complicated onboarding new contributors and Ci.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#28

Post by stblack »

tialaramex wrote: post #15
stblack wrote: post #11

Incidentally I'm onboarding someone new to git and Github. I must say, Github is now exceedingly difficult to set up. Vocalizing every step of the process, hopefully not in a hand-wavy way, it strikes me how hard this must be for unguided noobs. To some degree, this must be crushing the value of the service. If ever there was a crying need for setup wizards, configuration audit helpers, and clear error messages, this…

Well, I mean, if you're learning from Rust note that cargo just automatically makes new projects a git repository if that's possible, in the same way it defaults to your new project's code being a trivial implementation of "Hello, world." so that it will build and run before you write any code, and it defaults to providing you a working HTML documentation build and unit test framework. Plus of course it's access to t…

Sorry I may have been unclear?

I'm referring to what's required to make a local git repo interoperate with Github.

Either via the command line, or with an editor plugin, or an app. Including the Github desktop app.

That's a nightmare.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#29

Post by stblack »

Invictus0 wrote: post #25
stblack wrote: post #11

Incidentally I'm onboarding someone new to git and Github. I must say, Github is now exceedingly difficult to set up. Vocalizing every step of the process, hopefully not in a hand-wavy way, it strikes me how hard this must be for unguided noobs. To some degree, this must be crushing the value of the service. If ever there was a crying need for setup wizards, configuration audit helpers, and clear error messages, this…

It's really not that hard. Install the GitHub CLI and it gives you a simple setup wizard on first run. The GitHub page for the CLI also has clear and simple instructions on how to install it for any OS.

Hmmm. Maybe you haven't done that from scratch recently? The deprecation of passwords for tokens is a fairly recent thing.

Try it with a fresh laptop: nothing pre-configured. Show someone new how you set up, from scratch.

You're gonna be shocked.

Re: Tell HN: GitHub no longer supporting unauthenticated `git://`

#30

Post by traverseda »

mzs wrote: post #26
traverseda wrote: post #16

It seems like mostly the effects of all these auth changes are twofold * ~~Force~~ Encourage people to have github accounts * Make using plain git more difficult (auth tokens, deprecating passwords, etc) while encouraging people to use the github cli tool Given microsoft's history of "embrace, extend, extinguish" I have a hard time seeing these changes as anything other than an attack on git as an open ecosystem.

It really wasn't that hard, just created a key pair and added this to my ~/.ssh/config Host github.com Hostname github.com User git IdentitiesOnly yes IdentityFile ~/.ssh/github-id_rsa Lots of other ways to do it as well: https://superuser.com/questions/232373/how-to-tell-git-which...

Of course now every pull is authenticated and they can track exactly what users are pulling from what public repositories. Before it used to be that I only really authenticated when I did a git push.

So now when using plain git the choices are to have every action tracked, or to go through a very annoying process involving randomly generated keys.

Not that they couldn't guess that information based on IP address (presuming you're not behind a university NAT or something), but removing password auth does seem like a pretty clear attempt at gathering more user data.

Post reply on HN