Re: .gitmodules security

On 06 Feb 2022 14:59, Alex Ameen wrote:
> Hey, I can't claim to be an expert about this category of vulnerability; 
> but I appreciate you raising this concern.

it requires more than a MITM to be successful.  you'd also have to come up with
a sha1 collision which is non-trivial for most people.  not out of the reach of
nation states, but we prob aren't the target market :p.

i'm not against changing to https of course, just providing a bit more color.

> So is your recommendation to use 
> https://git.savannah.gnu.org/git/gnulib.git instead of 
> git://git.sv.gnu.org/gnulib.git?

i'll note that just about every GNU project utilizes gnulib is using the git://
style.  looks like gnulib itself only changed its advice about a year ago.
http://git.savannah.gnu.org/cgit/gnulib.git/commit/?h=b7da35aebaeece97dd8946072952979bb67f8db2
-mike

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEuQK1JxMl+JKsJRrUQWM7n+g39YEFAmIAQRMACgkQQWM7n+g3
9YG6/hAApdqN/CGy9ddmwQrmocgUyBH0ff9O0c1lZUjkgYccpMqBl6uqhP7EI0hj
VrOXsuomayKfw0Tvp3ZK4Km/0zoQQs1WDopRFntmQdJHzVRwPPqcj6abvPC+oQsJ
gMK6ycAEfrcF9Qd2ilpa9CoP2ma7QGPf9ha7MEdaEEbzrZDZtcmd9q4sLOt2NaU0
WQ9so8jGyCWYlPcFbdU8akYGbzSmP+cQUVu+tZKA2Duo5/VXPEqPlgjFQXiDS3LG
KOyIrIkm05KJEeDBcVI6PlJV/RAd8BvxJabfS+YmMeV2pFJd6Nd/AOYsmeuUqfCO
MV+EIINZcoP1VIG8LIf5gBE9vbiFNeGPAad8uQ/ESwdkU2oyrfVw2y0qjZ9Rbdc1
dc2zin/twRzc1Yf58erg9wZ3ThLfVTdDJfAHBIHDL656/BFPFMnJ2pC25LxuXSrv
DoFoS3fwi3OIoAiu/0xStkCB1tLxUqVfijOLVWP+xL6TN3f9om3eOdhisf7EP09y
FAPOCHggMTc5E+oLnBeu6ih0xlp0AI+lvouiiPWIQBBfg8QSwGtiWF1KUOvZZ3Gw
kjNsXeMO3y8gUCmL6sRpoF/YTBG5eeFxQ0L329Phd4SHQdJxsax0B4hWGtJWcXK4
/yL581r3MPM2csT1TrV20sHFZ4/c5RweSZw2zxrmjv31evNiaVo=
=dHLM
-----END PGP SIGNATURE-----