On Mon, Apr 15, 2002 at 10:44:28PM -0400, Perry E. Metzger wrote:
> Garrett Rooney <rooneg@electricjellyfish.net> writes:
> > > BTW, I'm perfectly happy using naked Apache as the front end for the
> > > anonymous CVS equivalent in SVN.
> >
> > well, in that case you could simple disallow commit's via ra_dav, and
> > make people log in and use ra_local for that.
>
> That won't help. The problem is things like buffer overflows in
> Apache,
There is nothing to support that Apache has problematic buffer overflows.
Most of the problems over the past year or two have been related to poor
processing rather than overflows. We've had a couple overflows on Windows,
but that's about it.
Heck, there isn't anything that says that Subversion doesn't have buffer
overflows. New code. New problems.
And you know... for that matter, has anybody actually audited CVS? Hoo... I
have seen its network code. Ohmigod. I double-dare you to audit that.
> not whether the system enforces protection if functioning
> correctly. The nice thing about sshd is that although it is not
> perfect, it is at least one narrow interface one has to worry
> about (and have to run on our systems anyway).
One port for subversion is not a big deal. Your admins will still need the
sshd port, but you can reduce your logins to *JUST* the admins. The devs
don't need system accounts or access to the sshd port.
You're trading one port for another.
>...
> > or, you can write ra_ssh (or ra_pipe, as people on irc were
> > talking about, since there's no reason to require this to be used via
> > ssh, we could use anything we can read and write to).
>
> That's more or less the point. We sort of need such a
> thing. Unfortunately, I'm insufficiently skilled to do so on my own.
That would be interesting, and we'd certainly accept the code, but I don't
think it will buy you much (for your use case) relative to Subversion over
SSL.
Cheers,
-g
--
Greg Stein, http://www.lyra.org/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Tue Apr 16 09:09:42 2002