git.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Junio C Hamano <gitster@pobox.com>
To: M Hickford <mirth.hickford@gmail.com>
Cc: git@vger.kernel.org,  sandals@crustytoothpaste.net,
	 stolee@gmail.com, avarab@gmail.com,  Johannes.Schindelin@gmx.de,
	 peff@peff.net
Subject: Re: Changing transfer.credentialsInUrl to default to "warn"
Date: Mon, 13 Jan 2025 08:42:34 -0800	[thread overview]
Message-ID: <xmqq1px6br7p.fsf@gitster.g> (raw)
In-Reply-To: <20250111071500.710169-1-mirth.hickford@gmail.com> (M. Hickford's message of "Sat, 11 Jan 2025 07:15:00 +0000")

M Hickford <mirth.hickford@gmail.com> writes:

> In order to nudge users towards more secure practices (namely,
> using a credential helper), would anyone else be in favour of
> changing transfer.credentialsInUrl to default to "warn"?

I personally do not have a problem with the proposal, but it is
curious that it is documented as inspecting only .URL and .pushURL
is not checked.  So, in addition to "once we start warning by
default, we'd need an advice message to tell the users how to turn
it off" Derrick says in the commit log message, we would probably
want to see if we should/can cover .pushURL and need necessary updates
before it happens.

Thanks.



  reply	other threads:[~2025-01-13 16:42 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-01-11  7:15 Changing transfer.credentialsInUrl to default to "warn" M Hickford
2025-01-13 16:42 ` Junio C Hamano [this message]
2025-01-13 21:53   ` Johannes Schindelin
2025-01-13 22:27     ` Junio C Hamano
2025-01-13 21:54   ` brian m. carlson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=xmqq1px6br7p.fsf@gitster.g \
    --to=gitster@pobox.com \
    --cc=Johannes.Schindelin@gmx.de \
    --cc=avarab@gmail.com \
    --cc=git@vger.kernel.org \
    --cc=mirth.hickford@gmail.com \
    --cc=peff@peff.net \
    --cc=sandals@crustytoothpaste.net \
    --cc=stolee@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).