Re: git-daemon on NSLU2

Linus Torvalds [off-list ref] writes:

quoted

I'm not buying the security argument. If you want something kept hidden 
get it out of the public db. If I know the sha of the hidden object 
can't I just add a head for it and git-deamon will happily send it and 
the chain up to it to me?

That's a particularly idiotic statement.

If you know the SHA1, there can *by*definition* not be any hidden objects. 
The SHA1 depends on the object chain.

I think what we have is even stronger --- upload-pack does not
allow asking for an arbitrary commit.  The requesting fetch-pack
side needs to pick from what are offerred, and upload-pack makes
sure of that.