Re: Supporting git access via smart HTTPS protocol for musl-libc

["A. Wilcox" <awilfox@adelielinux.org>]

[-- Attachment #1.1: Type: text/plain, Size: 1986 bytes --]

On 03/25/19 20:09, vlse wrote:
> Hello,
> 
> Would musl-libc support git access via smart HTTPS protocol.
> As git man page says as well as stackoverflow site that using git protocol
> is fine for lan operations.
> But for internet git access, either ssh or https smart protocol use
> is necessary to prevent man in the middle attack.


This is more an argument for signing commits so that they are
cryptographically provable.  HTTPS is trivial to MITM, especially for
the kind of actors that would care enough to MITM musl at all.

Threat models, people.


> Please consider giving secure git access. Also smart http/s protocol
> is way better than dumb protocol. It avoids downloading too much data
> again and also shows progress and stats.


There is absolutely no difference in transmitted data between the Git
protocol and the HTTP Git transport, other than the useless overhead of
HTTP messages, which actually skews favour towards the Git protocol.
Also, the Git protocol is in my experience much much faster.

The Git transport definitely can show progress and stats, the same as
the HTTP transport:

awilcox on gwyn [pts/18 Mon 25 20:13] ~: git clone
git://git.musl-libc.org/musl
Cloning into 'musl'...
remote: Counting objects: 31396, done.
remote: Compressing objects: 100% (12589/12589), done.
remote: Total 31396 (delta 22605), reused 25698 (delta 18440)
Receiving objects: 100% (31396/31396), 4.77 MiB | 3.17 MiB/s, done.
Resolving deltas: 100% (22605/22605), done.


(It did show the progress as it was downloading, but since I am on a
fairly fast link, I couldn't copy it.)

Personally I would be okay with musl offering an HTTP(S) transport as an
option, but please do not take away the Git transport.  It is much
faster in my experience.  Every second wasted on stupid HTTP traffic is
a second of my life I can't get back.

--arw

-- 
A. Wilcox (awilfox)
Project Lead, Adélie Linux
https://www.adelielinux.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]