Re: Supporting git access via smart HTTPS protocol for musl-libc

[vlse <vlse@veera.biz>]

Hi,

On Mon, Mar 25, 2019 at 08:17:26PM -0500, A. Wilcox wrote:
> On 03/25/19 20:09, vlse wrote:
> > Hello,
> > 
> > Would musl-libc support git access via smart HTTPS protocol.
> > As git man page says as well as stackoverflow site that using git protocol
> > is fine for lan operations.
> > But for internet git access, either ssh or https smart protocol use
> > is necessary to prevent man in the middle attack.
> 
> This is more an argument for signing commits so that they are
> cryptographically provable.  HTTPS is trivial to MITM, especially for
> the kind of actors that would care enough to MITM musl at all.
> 

How HTTPS is trivial to MITM.
If we have secure certificates from musl site, then MITM is not possible.
And many important transactions in the world depend on https.

> 
> > Please consider giving secure git access. Also smart http/s protocol
> > is way better than dumb protocol. It avoids downloading too much data
> > again and also shows progress and stats.
> 
> There is absolutely no difference in transmitted data between the Git
> protocol and the HTTP Git transport, other than the useless overhead of
> HTTP messages, which actually skews favour towards the Git protocol.
> Also, the Git protocol is in my experience much much faster.
> 

Yeah I know git protocol is faster.
And http/s does have little more overhead.
For HTTP/S there are two protocols dumb and smart.
And here in it are the differences.

> 
> The Git transport definitely can show progress and stats, the same as
> the HTTP transport:
> 
> 
> awilcox on gwyn [pts/18 Mon 25 20:13] ~: git clone
> git://git.musl-libc.org/musl
> Cloning into 'musl'...
> remote: Counting objects: 31396, done.
> remote: Compressing objects: 100% (12589/12589), done.
> 

I was not comparing http/s with git protocol. But http/s smart with http/s dumb protocol.
Dumb protolcol does not shows progress and stats.

Also dumb protocol of http/s has more overhead for subsequent git pull or fetch.

> 
> Personally I would be okay with musl offering an HTTP(S) transport as an
> option, but please do not take away the Git transport.  It is much
> faster in my experience.  Every second wasted on stupid HTTP traffic is
> a second of my life I can't get back.
> 

I was not requesting to stop git protocol. All I wanted was addition of https
smart protocol for additional security and safety for git access in internet.

> --arw
> A. Wilcox (awilfox)
> Project Lead, Adélie Linux
> https://www.adelielinux.org
> 

Regards,
Veera