Re: [RFC] Adding a challenge-response authentication method to git://

["Stephen R. van den Berg" <srb@cuci.nl>]

Petr Baudis wrote:
>On Thu, Aug 14, 2008 at 01:07:39PM +0200, Stephen R. van den Berg wrote:
>> Well, I looked into gitosis, and it solves part of the problem, it has a
>> few downsides though:

>> - It depends on Python for no particular reason (it might as well have
>>   been built using shellscripts only, or if need be Perl, since git
>>   already uses that); yet any extra dependency is creating an extra
>>   hurdle for portability and adoption.

>Is this concern really any kind of practical one? To me it appears that
>Python and Perl are both so extremely wide-spread that this might be
>issue only on embedded systems, exotic systems with very low proportion
>of git users, and users with strong ideological opinions about the
>system (probably low proportion of git users too).

I agree that in general it shouldn't be a major problem to get it on the
systems you want to use it on; but it does increase the difficulty of
auditing the solution before deploying it.

>> Other than that, gitosis looks fairly good if you want to use public
>> keys.

>This doesn't seem to be convincing reason for _reimplementing_ the
>solution. (Of course, I don't prevent you from doing that, I'm just
>wondering about the feasibility.)

I'm not going to reimplement gitosis.  I'm going to do *less* than
gitosis for situations where gitosis is undesirable (for whatever
reason, not necessarily the critisisms I mentioned before).
-- 
Sincerely,
           Stephen R. van den Berg.

"Hold still, while I inject you with SQL."