Re: policy and mechanism for less-connected clients

Theodore Tso [off-list ref] writes:

And when you have shared push repositories, as long as users don't use
the '+', in practice they can only add new changes.  And if you don't
trust them not to use the '+' character in refspecs, are you really
going to trust them not to introduce either bone-headed mistakes into
the code?

Well, if you do not trust them, just set receive.denynonfastforwards
and they won't be able to.