On 03/25/19 20:43, vlse wrote:
> Hi,
> 
> On Mon, Mar 25, 2019 at 08:17:26PM -0500, A. Wilcox wrote:
>> On 03/25/19 20:09, vlse wrote:
>>> Hello,
>>>
>>> Would musl-libc support git access via smart HTTPS protocol.
>>> As git man page says as well as stackoverflow site that using git protocol
>>> is fine for lan operations.
>>> But for internet git access, either ssh or https smart protocol use
>>> is necessary to prevent man in the middle attack.
>>
>> This is more an argument for signing commits so that they are
>> cryptographically provable.  HTTPS is trivial to MITM, especially for
>> the kind of actors that would care enough to MITM musl at all.
>>
> 
> How HTTPS is trivial to MITM.


I was under the (apparently false) impression that Git does not do host
name nor CA validation.  That is, as long as it can successfully connect
to port 443 with TLS, the connection will succeed.  This was an issue a
long time ago especially in Windows Git builds, but it looks like the
default for http.sslVerify is now 'true' instead of 'false' (at least on
Unix) so you may disregard that.  I apologise.


> If we have secure certificates from musl site, then MITM is not possible.
> And many important transactions in the world depend on https.
> 
>>
>>> Please consider giving secure git access. Also smart http/s protocol
>>> is way better than dumb protocol. It avoids downloading too much data
>>> again and also shows progress and stats.
>>
>> There is absolutely no difference in transmitted data between the Git
>> protocol and the HTTP Git transport, other than the useless overhead of
>> HTTP messages, which actually skews favour towards the Git protocol.
>> Also, the Git protocol is in my experience much much faster.
>>
> 
> Yeah I know git protocol is faster.
> And http/s does have little more overhead.
> For HTTP/S there are two protocols dumb and smart.
> And here in it are the differences.
> 
>>
>> The Git transport definitely can show progress and stats, the same as
>> the HTTP transport:
>>
>>
>> awilcox on gwyn [pts/18 Mon 25 20:13] ~: git clone
>> git://git.musl-libc.org/musl
>> Cloning into 'musl'...
>> remote: Counting objects: 31396, done.
>> remote: Compressing objects: 100% (12589/12589), done.
>>
> 
> I was not comparing http/s with git protocol. But http/s smart with http/s dumb protocol.
> Dumb protolcol does not shows progress and stats.


I'm sorry, I misunderstood.


> Also dumb protocol of http/s has more overhead for subsequent git pull or fetch.
> 
>>
>> Personally I would be okay with musl offering an HTTP(S) transport as an
>> option, but please do not take away the Git transport.  It is much
>> faster in my experience.  Every second wasted on stupid HTTP traffic is
>> a second of my life I can't get back.
>>
> 
> I was not requesting to stop git protocol. All I wanted was addition of https
> smart protocol for additional security and safety for git access in internet.


That sounds reasonable.

Again, I apologise for misunderstanding.  I had a rough weekend and
probably shouldn't have been writing emails.

Best to you and yours,
--arw

-- 
A. Wilcox (awilfox)
Project Lead, Adélie Linux
https://www.adelielinux.org