Re: [RFC 0/2] Git-over-TLS (gits://) client side support

[Ilari Liusvaara <ilari.liusvaara@elisanet.fi>]

On Wed, Jan 13, 2010 at 03:13:40PM -0500, Avery Pennarun wrote:
> On Wed, Jan 13, 2010 at 3:06 PM, Ilari Liusvaara
> 
> Lots of people use it.  That was my point.  If it weren't important,
> web browser makers wouldn't bother putting it in; God knows they leave
> out a lot of other stuff that I'd like.

There are two kinds of "important". Actually important for users and
important for managers.
 
The latter tends to be implemented with much less real world need. And
one can usually tell which of those it was from usability of feature.

> >> Furthermore, how many people who really want ssh-style keypairs (and
> >> thus refuse to use X.509 and PKI) can't just use ssh as their git
> >> transport?  I don't actually understand what the goal is here.
> >
> > As said, I got fed up with failure modes of SSH.
> 
> I think this is the answer that needs clarification.  What failure
> modes are these?  ssh doesn't seem to fail for me.  And github.com
> seems to be working rather well with a huge number of users and ssh
> authentication.

Those failure modes tend to be show up at setup phase. But when they
show up, at worst I have seen ones that took hours to debug because
of multitude of possible causes and no good information on what's
wrong.

And don't get me started about multi-key setups.

SSH uses fixed sets of keys, which has inherent failure modes. And ssh
server tends to be worse than the client (Github can avoid the server
failure modes since they control the SSH server).

But not even github can avoid all the failure modes.

> If you're upset at the failure modes of ssh, is it possible to fix ssh
> instead of introducing Yet Another Tunneling Protocol?

No, those failure modes can't be solved in SSH.

-Ilari