[SSL Observatory] Observatory source code available via git

Matt McCutchen matt at mattmccutchen.net
Fri May 13 06:55:55 PDT 2011


On Wed, 2011-05-11 at 19:12 -0700, Andy Isaacson wrote:
> It's significantly more efficient -- especially for incremental pulls --
> to use a git:// URL.  However this does mean you're running the git
> daemon, which while it's fairly widely used and audited, is additional
> exposure surface compared to just running Apache.

As I'm sure those on this list will appreciate, the git: scheme provides
no integrity protection.  Running the "smart" protocol over https: would
be a better choice.

-- 
Matt




More information about the Observatory mailing list