# Secure SVN access

- Thread: https://externals.io/message/45466
- Original archive: https://news-web.php.net/php.internals/45466
- Started by techtonik on 2009-09-03T12:48:26+00:00
- Messages: 5
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #45466 — techtonik — 2009-09-03T12:48:26+00:00

URL: https://externals.io/message/45466#45466

Greeetings to php-core developers,

Am I right that there is no https:// and svn+ssh:// access to
svn.php.net repositories?
If that's the case - how do you feel about sniffing developer's passwords?

Please, CC.

--anatoly t.

---

## #45467 — Scott MacVicar — 2009-09-03T12:54:51+00:00

URL: https://externals.io/message/45466#45467 · In reply to: #45466

> Greeetings to php-core developers,
>
> Am I right that there is no https:// and svn+ssh:// access to
> svn.php.net repositories?
> If that's the case - how do you feel about sniffing developer's  
> passwords?
>

We use Digest authentication so while they are sniffable its not  
replayable and they are hashed with a nonce.

Scott

---

## #45468 — Uwe Schindler — 2009-09-03T12:55:43+00:00

URL: https://externals.io/message/45466#45468 · In reply to: #45466

Hi anatoly,

there problem is not only with SVN. In principle if a developer logs in to
the PHP bug tracking system on http://bugs.php.net he also uses his password
in plain text. Because of this, I see no difference here. I personally use a
different password for PHP and no high-security one I use elsewhere.

In general PHP is Open Source Software, if somebody misuses a PHP's
developers passwords, all these changes can be reverted in SVN, so I see no
problem. Additionally all commits are reviewed by the commit mailing list
subscribers (all developers).

-----
Uwe Schindler
thetaphi@php.net - http://www.php.net
NSAPI SAPI developer
Bremen, Germany

> -----Original Message-----
> From: techtonik@gmail.com [mailto:techtonik@gmail.com] On Behalf Of
> techtonik
> Sent: Thursday, September 03, 2009 2:48 PM
> To: internals@lists.php.net
> Subject: [PHP-DEV] Secure SVN access
> 
> Greeetings to php-core developers,
> 
> Am I right that there is no https:// and svn+ssh:// access to
> svn.php.net repositories?
> If that's the case - how do you feel about sniffing developer's passwords?
> 
> Please, CC.
> 
> --anatoly t.

---

## #45469 — Richard Quadling — 2009-09-03T12:56:14+00:00

URL: https://externals.io/message/45466#45469 · In reply to: #45466

2009/9/3 techtonik <techtonik@php.net>:
> Greeetings to php-core developers,
>
> Am I right that there is no https:// and svn+ssh:// access to
> svn.php.net repositories?
> If that's the case - how do you feel about sniffing developer's passwords?
>
> Please, CC.
>
> --anatoly t.
>
> --
> 
> 
>
>

Was this any different when using cvs?

-- 
-----
Richard Quadling
"Standing on the shoulders of some very clever giants!"
EE : http://www.experts-exchange.com/M_248814.html
Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731
ZOPA : http://uk.zopa.com/member/RQuadling

---

## #45470 — Gwynne Raskind — 2009-09-03T13:34:25+00:00

URL: https://externals.io/message/45466#45470 · In reply to: #45469

> 2009/9/3 techtonik <techtonik@php.net>:
> > […]
>
> Was this any different when using cvs?


No, it wasn't. We ran into a number of problems attempting to set up https:// 
  access to SVN, not the least of which was an outdated kernel on one  
of our boxes. Since then I've been waiting for word from Rasmus, who  
was trying to get the box upgraded, but I never got that word, so  
we're still http:// only.

-- Gwynne