From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/14004 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: "A. Wilcox" Newsgroups: gmane.linux.lib.musl.general Subject: Re: Supporting git access via smart HTTPS protocol for musl-libc Date: Mon, 25 Mar 2019 21:29:51 -0500 Organization: =?UTF-8?Q?Ad=c3=a9lie_Linux?= Message-ID: <61bbf692-dfc6-aef8-5f26-5d9d46de6aa3@adelielinux.org> References: <20190324103306.GB1830@localhost> <20190326003411.GC1872@localhost> <20190326010933.GC3713@localhost> <397c5906-090a-460e-7ea8-8f9248e0be59@adelielinux.org> <20190326014346.GA8855@localhost> Reply-To: musl@lists.openwall.com Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="SeDt63DUg53f2oCuV95QiC58dO4nWA8a4" Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="100211"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Mozilla/5.0 (X11; Linux ppc64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 To: vlse , musl@lists.openwall.com Original-X-From: musl-return-14020-gllmg-musl=m.gmane.org@lists.openwall.com Tue Mar 26 03:29:07 2019 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.89) (envelope-from ) id 1h8bpp-000Puc-Ek for gllmg-musl@m.gmane.org; Tue, 26 Mar 2019 03:29:05 +0100 Original-Received: (qmail 7594 invoked by uid 550); 26 Mar 2019 02:29:03 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 7576 invoked from network); 26 Mar 2019 02:29:02 -0000 Openpgp: preference=signencrypt In-Reply-To: <20190326014346.GA8855@localhost> Xref: news.gmane.org gmane.linux.lib.musl.general:14004 Archived-At: This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --SeDt63DUg53f2oCuV95QiC58dO4nWA8a4 Content-Type: multipart/mixed; boundary="mrvclGxYn8cC9Vvb1DunHsF4MoJQku8dp"; protected-headers="v1" From: "A. Wilcox" To: vlse , musl@lists.openwall.com Message-ID: <61bbf692-dfc6-aef8-5f26-5d9d46de6aa3@adelielinux.org> Subject: Re: [musl] Supporting git access via smart HTTPS protocol for musl-libc References: <20190324103306.GB1830@localhost> <20190326003411.GC1872@localhost> <20190326010933.GC3713@localhost> <397c5906-090a-460e-7ea8-8f9248e0be59@adelielinux.org> <20190326014346.GA8855@localhost> In-Reply-To: <20190326014346.GA8855@localhost> --mrvclGxYn8cC9Vvb1DunHsF4MoJQku8dp Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 03/25/19 20:43, vlse wrote: > Hi, >=20 > On Mon, Mar 25, 2019 at 08:17:26PM -0500, A. Wilcox wrote: >> On 03/25/19 20:09, vlse wrote: >>> Hello, >>> >>> Would musl-libc support git access via smart HTTPS protocol. >>> As git man page says as well as stackoverflow site that using git pro= tocol >>> is fine for lan operations. >>> But for internet git access, either ssh or https smart protocol use >>> is necessary to prevent man in the middle attack. >> >> This is more an argument for signing commits so that they are >> cryptographically provable. HTTPS is trivial to MITM, especially for >> the kind of actors that would care enough to MITM musl at all. >> >=20 > How HTTPS is trivial to MITM. I was under the (apparently false) impression that Git does not do host name nor CA validation. That is, as long as it can successfully connect to port 443 with TLS, the connection will succeed. This was an issue a long time ago especially in Windows Git builds, but it looks like the default for http.sslVerify is now 'true' instead of 'false' (at least on Unix) so you may disregard that. I apologise. > If we have secure certificates from musl site, then MITM is not possibl= e. > And many important transactions in the world depend on https. >=20 >> >>> Please consider giving secure git access. Also smart http/s protocol >>> is way better than dumb protocol. It avoids downloading too much data= >>> again and also shows progress and stats. >> >> There is absolutely no difference in transmitted data between the Git >> protocol and the HTTP Git transport, other than the useless overhead o= f >> HTTP messages, which actually skews favour towards the Git protocol. >> Also, the Git protocol is in my experience much much faster. >> >=20 > Yeah I know git protocol is faster. > And http/s does have little more overhead. > For HTTP/S there are two protocols dumb and smart. > And here in it are the differences. >=20 >> >> The Git transport definitely can show progress and stats, the same as >> the HTTP transport: >> >> >> awilcox on gwyn [pts/18 Mon 25 20:13] ~: git clone >> git://git.musl-libc.org/musl >> Cloning into 'musl'... >> remote: Counting objects: 31396, done. >> remote: Compressing objects: 100% (12589/12589), done. >> >=20 > I was not comparing http/s with git protocol. But http/s smart with htt= p/s dumb protocol. > Dumb protolcol does not shows progress and stats. I'm sorry, I misunderstood. > Also dumb protocol of http/s has more overhead for subsequent git pull = or fetch. >=20 >> >> Personally I would be okay with musl offering an HTTP(S) transport as = an >> option, but please do not take away the Git transport. It is much >> faster in my experience. Every second wasted on stupid HTTP traffic i= s >> a second of my life I can't get back. >> >=20 > I was not requesting to stop git protocol. All I wanted was addition of= https > smart protocol for additional security and safety for git access in int= ernet. That sounds reasonable. Again, I apologise for misunderstanding. I had a rough weekend and probably shouldn't have been writing emails. Best to you and yours, --arw --=20 A. Wilcox (awilfox) Project Lead, Ad=C3=A9lie Linux https://www.adelielinux.org --mrvclGxYn8cC9Vvb1DunHsF4MoJQku8dp-- --SeDt63DUg53f2oCuV95QiC58dO4nWA8a4 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEjNyWOYPU1SaTSMHHyynLUZIrnRQFAlyZjp8ACgkQyynLUZIr nRRQSA/+PFHO1G7L6CNQB8qQU96VWv8N2vTwzGvD0AKE+6uCM37VuKZZPOpT4M7P vzQ+49x0ZHrOW6/+VsOsOFyc6v1CLpvVKP+Mu3FG5/rmriVJuyMM7nWikx5mskij q3I1CC435329q9+hROd0f3SUovmi6Nl4dC86n05E/1DGayx8ZcAAJMOA6HSO84XX 5gz7DcJxB8/aBEQybszWFXXQQsL6plSZ5kDo/ZD+TE5Y18J8JefoBexnI9BW+r13 Q6JkLk/wu/vm82k/I4Dv9eC1MHM3iKHydnFr6WR2ul4a07xGKVkOctUa4zzVEXXc HRxLT2BQ0FQfTlzzFMyHdFg2yjF/9Un04d9xaue/TpysqyrKZ6VXx+MMsiXsomvr Jx26hVRYUqS/BQBYJ2UoeKsdyk2rCdUU1LzKfKMgU/NjYC7Eog3JygI4+mwYEQIM cU2U+neuTf2ngFIuPMW+Op7Unrpm0YrF8jt6rwG6nPXWUpdt0Oc9M6eVbOg5zmFN SCE6FgE/KXx/PRCdooKfCoxFgn5PrzLqN50ir8G5IxNP7K8oa/Jf9GY/qWWppuzP 7u2GWVwgn23KGP59IDTEHBbH/nYSkC8QOsBX8CUhrKtc9izrgX+4fVm6chJHXbVA 7b7U0WNilH3uZiu+KKdbk2BH3PXe99/PtdJEhpddsUBH74TbgnA= =MlA4 -----END PGP SIGNATURE----- --SeDt63DUg53f2oCuV95QiC58dO4nWA8a4--