documentation: add git:// transport security notice
The fact that the git:// transport does no authentication is easily overlooked. For example, DNS poisoning may result in fetching from somewhere that was not intended. Add a brief security notice to the "GIT URLS" section of the documentation stating that the git transport should be used with caution on unsecured networks. Signed-off-by: Fraser Tweedale <frase@frase.id.au> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Fraser Tweedale committed
Jun 26, 2013 at 15:53 UTC
20618016df1255a2adebe900af7d66f88ef7a33b
1 file changed
+3
Documentation/urls.txt
+3
@@ -11,6 +11,9 @@ and ftps can be used for fetching and rsync can be used for fetching
11
and pushing, but these are inefficient and deprecated; do not use
12
them).
13
14
+The native transport (i.e. git:// URL) does no authentication and
15
+should be used with caution on unsecured networks.
16
+
17
The following syntaxes may be used with them:
18
19
- ssh://{startsb}user@{endsb}host.xz{startsb}:port{endsb}/path/to/repo.git/