git.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Junio C Hamano <gitster@pobox.com>
To: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Cc: M Hickford <mirth.hickford@gmail.com>,
	 git@vger.kernel.org, sandals@crustytoothpaste.net,
	 stolee@gmail.com,  avarab@gmail.com, peff@peff.net
Subject: Re: Changing transfer.credentialsInUrl to default to "warn"
Date: Mon, 13 Jan 2025 14:27:16 -0800	[thread overview]
Message-ID: <xmqq34hm8i4b.fsf@gitster.g> (raw)
In-Reply-To: <7a60c9ec-8f98-73d3-4539-d96b63a4f442@gmx.de> (Johannes Schindelin's message of "Mon, 13 Jan 2025 22:53:46 +0100 (CET)")

Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:

> The reason why `.pushURL` was not handled as well is that it is way too
> common for Git users to call `git clone https://<user>:<password>@<host>`
> ...
> There is no similar indirect way to leak credentials into `pushURL`

Ah, so it is not primarily between .URL vs .pushURL, but the
difference is between "clone" that leaves the URL used on the
command line in the configuraiton, vs "push" that does not.

And because .pushURL has to be explicitly configured by the
end-user, there is much less need to remind that they are _storing_
credential material in the configuration files.

The reasoning does make sense.

> Having said that, I would be in favor of letting
> `transfer.credentialsInURL` treat `remote.*.pushURL` in the same manner as
> `remote.*.url`.

Amen to that.  Thanks.

  reply	other threads:[~2025-01-13 22:27 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-01-11  7:15 Changing transfer.credentialsInUrl to default to "warn" M Hickford
2025-01-13 16:42 ` Junio C Hamano
2025-01-13 21:53   ` Johannes Schindelin
2025-01-13 22:27     ` Junio C Hamano [this message]
2025-01-13 21:54   ` brian m. carlson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=xmqq34hm8i4b.fsf@gitster.g \
    --to=gitster@pobox.com \
    --cc=Johannes.Schindelin@gmx.de \
    --cc=avarab@gmail.com \
    --cc=git@vger.kernel.org \
    --cc=mirth.hickford@gmail.com \
    --cc=peff@peff.net \
    --cc=sandals@crustytoothpaste.net \
    --cc=stolee@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).