From: "Ævar Arnfjörð Bjarmason" <avarab@gmail.com>
To: Federico Lucifredi <flucifredi@acm.org>
Cc: git@vger.kernel.org
Subject: Re: BUG REPORT: git clone of non-existent repository results in request for credentials
Date: Sun, 11 Nov 2018 15:00:15 +0100 [thread overview]
Message-ID: <87y39z3ea8.fsf@evledraar.gmail.com> (raw)
In-Reply-To: <708E1759-B2E3-436C-9D54-214159655B1B@acm.org>
On Sun, Nov 11 2018, Federico Lucifredi wrote:
> git clone of non-existent repository results in request for credentials
>
> REPRODUCING:
> sudo apt install git
> git clone https://github.com/xorbit/LiFePo4owered-Pi.git #this repo does not exist
>
> Git will then prompt for username and password on Github.
>
> I can see a valid data-leak concern (one could probe for private repository names in a brute-force fashion), but then again the UX impact is appalling. Chances of someone typing an invalid repo name are pretty high, and this error message has nothing to do with the actual error.
>
> RESOLUTION:
> The error message should indicate that the repository name does not exist.
This is a legitimate thing to complain about, but it has nothing to do
with git itself maintained on this mailing list, but the response codes
of specific git hosting websites. E.g. here's two issues for fixing this
on GitLab:
https://gitlab.com/gitlab-org/gitlab-ce/issues/50201
https://gitlab.com/gitlab-org/gitlab-ce/issues/50660
These hosting platforms are intentionally producing bad error messages
to not leak information, as you note.
So I doubt it's something they'll ever change, the bug I have open with
this on GitLab is to make this configurable for privately run instances.
next prev parent reply other threads:[~2018-11-11 14:02 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-11 9:22 BUG REPORT: git clone of non-existent repository results in request for credentials Federico Lucifredi
2018-11-11 14:00 ` Ævar Arnfjörð Bjarmason [this message]
2018-11-11 18:00 ` Federico Lucifredi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y39z3ea8.fsf@evledraar.gmail.com \
--to=avarab@gmail.com \
--cc=flucifredi@acm.org \
--cc=git@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).