Re: cvs.debian.org problem
On Thu, Jan 30, 2003 at 11:58:59PM -0500, Matt Zimmerman wrote:
> On Thu, Jan 30, 2003 at 02:21:35PM -0600, Steve Greenland wrote:
> > Are you saying that network access via subversion is no more secure than
> > CVS pserver? Can you point me at info about this? (I'm not arguing with
> > you, I'm just surprised, as I thought one of the goals of svn was better
> > c/s than CVS.)
>
> I don't know whether it is a goal or not, but subversion is still very much
> under development, and some of its goals have not yet been met.
>
> Currently, the only secure access method for subversion is to use a local
> repository. cvs can be quite reasonably secured using rsh-tunneled
> operation with ssh, while the only network option for subversion is https,
> and subversion does not verify server certificates, leaving the door open
> for a man-in-the-middle attack.
>
> At least, this was the case when I last investigated it.
You're now out of date. As of 0.16 or so, Subversion has an
SSH-tunnellable protocol (ra_svn), and work on SSL certificates is
progressing.
--
Colin Watson [cjwatson@flatline.org.uk]
Reply to: