From 20618016df1255a2adebe900af7d66f88ef7a33b Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Wed, 26 Jun 2013 15:53:59 +1000 Subject: documentation: add git:// transport security notice The fact that the git:// transport does no authentication is easily overlooked. For example, DNS poisoning may result in fetching from somewhere that was not intended. Add a brief security notice to the "GIT URLS" section of the documentation stating that the git transport should be used with caution on unsecured networks. Signed-off-by: Fraser Tweedale Signed-off-by: Junio C Hamano diff --git a/Documentation/urls.txt b/Documentation/urls.txt index 3ca122f..5992ede 100644 --- a/Documentation/urls.txt +++ b/Documentation/urls.txt @@ -11,6 +11,9 @@ and ftps can be used for fetching and rsync can be used for fetching and pushing, but these are inefficient and deprecated; do not use them). +The native transport (i.e. git:// URL) does no authentication and +should be used with caution on unsecured networks. + The following syntaxes may be used with them: - ssh://{startsb}user@{endsb}host.xz{startsb}:port{endsb}/path/to/repo.git/ -- cgit v0.10.2-6-g49f6