Justin Erenkrantz wrote:
> --On Wednesday, December 29, 2004 12:05 AM +0100 Tobias Ringström
> <tobias@ringstrom.mine.nu> wrote:
>
>> Anyway, that's a side track. Your point that Subversion should not cache
>> passwords by default is convincing, especially since we now have a knob
>> to control just that. I'll think about it some more and look into it.
>
> We shouldn't be changing defaults like that until 2.0. If a user
> wants to not cache passwords, the user only needs to change their
> ~/.subversion/config file. I don't see the problem here. -- justin
I think you're being overly conservative, because we have changed a lot
of defaults before. Just to mention a few such changes in 1.1.0, we made
"svnadmin recover" non-blocking, increased a neon timeout, started to
process svn:externals in defined order, and changed the default pegging.
All of them were changed for a good reason, of course. Why would this
change be different?
The good reason in this case is to behave more securely out of the box.
People how upgrade will not be hit very hard because their passwords
will still be cached. Only new credentials would be affected. Subversion
is pretty unique in that it stores passwords by default. On top of that,
it also stores them in plain text, and there is no good way to "forget"
passwords. I think a change would be a clear improvement, but I'm
certainly open to other opinions.
/Tobias
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Tue Jan 4 00:04:12 2005