On Fri, Dec 20, 2019 at 01:38:28AM +0100, Nicolas Dechesne wrote:
It should be fixed now. Please be aware that we don’t advertise /recommend using git:// and you should use https:// instead.
Specifically, the git protocol has some noticeable security weaknesses to it. It can be useful in a few circumstances, namely:
- You are referencing a specific commit, by full commit-id. Your local git command will verify all of the files/commits involved in producing that, and you will reliably get the intended commit.
- Signed tags should be safe, if you trust the public key of the signer.
Things like named branches, and unsigned tags, however, could be intercepted by a man-in-the-middle attack.
In general, try to use https:// (or git+ssh) if possible. Only use git:// if necessary, and you specifically have a full commit-id.
David