SAC members please confirm you can see this:
https://git.osgeo.org/gogs/sac/tracsvn-etc-trac
It is the global trac configuration, shared among all
trac instances.
--strk;
Sandro Santilli wrote:
SAC members please confirm you can see this:
https://git.osgeo.org/gogs/sac/tracsvn-etc-trac
"404"
Martin.
--
Unix _IS_ user friendly - it's just selective about who its friends are !
--------------------------------------------------------------------------
I can see it, after login.
Without login "404".
Christian
Am 23.05.2016 um 11:35 schrieb Sandro Santilli:
SAC members please confirm you can see this:
https://git.osgeo.org/gogs/sac/tracsvn-etc-tracIt is the global trac configuration, shared among all
trac instances.--strk;
_______________________________________________
Sac mailing list
Sac@lists.osgeo.org
http://lists.osgeo.org/mailman/listinfo/sac
On Mon, May 23, 2016 at 09:39:10AM +0000, Martin Spott wrote:
Sandro Santilli wrote:
> SAC members please confirm you can see this:
> https://git.osgeo.org/gogs/sac/tracsvn-etc-trac"404"
That's what you get unless you're logged in AND part
of the SAC group. Can you confirm you can see after login ?
--strk;
Sandro Santilli wrote:
On Mon, May 23, 2016 at 09:39:10AM +0000, Martin Spott wrote:
Sandro Santilli wrote:
> SAC members please confirm you can see this:
> https://git.osgeo.org/gogs/sac/tracsvn-etc-trac"404"
That's what you get unless you're logged in AND part
of the SAC group. Can you confirm you can see after login ?
Works after logging in, but why am I supposed to log in just for
read-only access alias browsing a repo ?
Martin.
--
Unix _IS_ user friendly - it's just selective about who its friends are !
--------------------------------------------------------------------------
On Mon, May 23, 2016 at 10:49:32AM +0000, Martin Spott wrote:
Sandro Santilli wrote:
> On Mon, May 23, 2016 at 09:39:10AM +0000, Martin Spott wrote:
>> Sandro Santilli wrote:
>>
>> > SAC members please confirm you can see this:
>> > https://git.osgeo.org/gogs/sac/tracsvn-etc-trac
>>
>> "404"
>
> That's what you get unless you're logged in AND part
> of the SAC group. Can you confirm you can see after login ?Works after logging in, but why am I supposed to log in just for
read-only access alias browsing a repo ?
Each repository can be configured to be either public or private.
In this case, it is a private repository. We can decide if we
want to make it public. Personally I'm creating configuration
repositories as private by default.
--strk;
Hi Sandro,
Sandro Santilli wrote:
On Mon, May 23, 2016 at 10:49:32AM +0000, Martin Spott wrote:
Works after logging in, but why am I supposed to log in just for
read-only access alias browsing a repo ?Each repository can be configured to be either public or private.
In this case, it is a private repository. We can decide if we
want to make it public. Personally I'm creating configuration
repositories as private by default.
Were observing different approaches of securing sensitive information,
it seems to me. Personally I'd rather not put sensitive config
information into a world-wide remote-accessible repository at all -
particularly not using a frontend whose auth mechanism doesn't feature
a well-known good reputation.
Therefore I'd suggest: If it requires protection, don't put it online
anywhere, if it doesn't require protection, make the repo public.
Opinions ?
Martin.
--
Unix _IS_ user friendly - it's just selective about who its friends are !
--------------------------------------------------------------------------
On Mon, May 23, 2016 at 02:21:55PM +0000, Martin Spott wrote:
Therefore I'd suggest: If it requires protection, don't put it online
anywhere, if it doesn't require protection, make the repo public.
"Don't put it online anywhere" would actually not be true.
It's really about how to protect access.
If it's not on the web it could still be accessed via ssh,
for example. Do you mean "don't make it available via http?"
or "don't make it available via Gogs" ?
I'd be ok with an ssh-only solution (gitolite is pretty good
for similar use cases ).
--strk;
Sandro Santilli wrote:
If it's not on the web it could still be accessed via ssh,
Indeed, we're talking about networked computers .... but isn't this
nit-picking ?
Martin.
--
Unix _IS_ user friendly - it's just selective about who its friends are !
--------------------------------------------------------------------------
On Mon, May 23, 2016 at 05:23:47PM +0000, Martin Spott wrote:
Sandro Santilli wrote:
> If it's not on the web it could still be accessed via ssh,
Indeed, we're talking about networked computers .... but isn't this
nit-picking ?
Yes and no. I'm basically asking what is exactly that you don't trust.
Is it the web, specifically ? Do you want to completely disable
HTTPS access to private repositories ?
--strk;
Am 23.05.2016 um 19:56 schrieb Sandro Santilli:
I'm basically asking what is exactly that you don't trust.
Anything and anybody! 
(No, just joking! But that's a good basic mindset for sysops, right?)
Basically: what you put out there on a web accessible server "is gone". No web based system is 100% secure... (Hacker, NSA, etc. will find a way if they really want the information).
> Do you want to completely disable HTTPS access to private repositories ?
If you ask me, no. But I see the concern raised, and would also not do it for configuration files with sensible infos like passwords. Though, I also see the benefits for collaboration...
Christian