Re: passwords in subversion

Ben Collins-Sussman <[email protected]> writes:
> Agreed.  But rather than implement a whole new (almost identical)
> authn system, why not just have svnserve store the user-db with a
> trivial scramble.  It solves the same "over the shoulder" problem,
> with a lot less work.

We will then get lots of posts saying "Do you realize your server-side
password encryption is totally insecure?"  (As happened with CVS, to a
degree.)

Of course, our answer will be "Yes, we know that."  But if the point
is to avoid stimulating these posts, I'm not sure that moving from
plaintext to trivial-scrambling is going to be effective.