Gentoo Archives: gentoo-dev

From: Andrew Savchenko <bircoph@g.o>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] Current Gentoo Git setup / man-in-the-middle attacks
Date: Sun, 29 Mar 2015 18:05:24
Message-Id: 20150329210452.21eae7451fb14f531ecd41f5@gentoo.org
In Reply to: Re: [gentoo-dev] Current Gentoo Git setup / man-in-the-middle attacks by Sebastian Pipping
1 On Sun, 29 Mar 2015 19:52:38 +0200 Sebastian Pipping wrote:
2 > On 29.03.2015 19:39, Andrew Savchenko wrote:
3 > > On Sun, 29 Mar 2015 18:41:33 +0200 Sebastian Pipping wrote:
4 > >> So I would like to propose that
5 > >>
6 > >> * support for Git access through https:// is activated,
7 > >>
8 > >> * Git access through http:// and git:// is deactivated, and
9 > >
10 > > Some people have https blocked. http:// and git:// must be
11 > > available read-only.
12 >
13 > They would not do online banking over http, right? Why would they run
14 > code with root privileges from http?
15
16 Gentoo tree access is not even near on the same security scale as
17 online banking.
18
19 Best regards,
20 Andrew Savchenko

Replies

Subject Author
[gentoo-dev] Re: Current Gentoo Git setup / man-in-the-middle attacks Duncan <1i5t5.duncan@×××.net>