[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: Feature Request: clients shouldn't store auth-creds

From: Ben Collins-Sussman <sussman_at_collab.net>
Date: 2005-01-05 21:39:06 CET

On Jan 5, 2005, at 2:19 PM, Peter N. Lundblad wrote:

> On Wed, 5 Jan 2005, Tobias Ringström wrote:
>> kfogel@collab.net wrote:
>> But the thread has drifted far away from it's origin. The issue is
>> whether Subversion should cache passwords by default or not. I still
>> feel that it should not for the reasons I stated earlier in this
>> thread,
>> but I'm also beginning to realize, much to my surprise, that I'm
>> pretty
>> alone with that opinion.
> No, you're not alone. I don't like programs that silently spread my
> passwords in different files on my hard drive without me noticing.
> There
> are ways to avoid this, but if I am just a little bit ignorant... I
> don't
> see why changing a default would be bad. Scripts can hardly rely on
> this
> config option set to a specific value, so it can't break compability.
> I am
> actually +1 on changing the default. This also sends a signal that we
> are
> taking security seriously.

I'd be okay with this also.

But we'd better be ready for a slew of newbies asking us how to make
subversion stop asking for their password. I predict it will jump into
the top 10 FAQs on the users@ list.

We may be gaining more security by default, but we're trading it for a
chunk of convenience and user-friendliness.

To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Wed Jan 5 21:42:13 2005

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.