mirrors/git-annex
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

clarification

Browse source
This commit is contained in:
Joey Hess 2017-03-02 13:28:31 -04:00
parent fe28cbcd9e
commit 701006bd83
No known key found for this signature in database
GPG key ID: C910D9222512E3C7
2 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
doc/tips/peer_to_peer_network_with_tor.mdwn
View file

@ -132,11 +132,11 @@ Tor hidden services can be quite secure. But this doesn't mean that using
git-annex over Tor is automatically perfectly secure. Here are some things git-annex over Tor is automatically perfectly secure. Here are some things
to consider: to consider:
* Anyone who learns the address of a peer can connect to that peer, * Anyone who learns the onion address address and authentication data of a peer
download the whole history of the git repository, and any available can connect to that peer, download the whole history of the git repository,
annexed files. They can also upload new files to the peer, and even and any available annexed files. They can also upload new files to the peer,
remove annexed files from the peer. So consider ways that the address and even remove annexed files from the peer. So consider ways that the
of a peer might be exposed. authentication data of a peer might be exposed.
* While Tor can be used to anonymize who you are, git defaults to including * While Tor can be used to anonymize who you are, git defaults to including
your name and email address in git commit messages. So if you want an your name and email address in git commit messages. So if you want an

15
doc/tips/peer_to_peer_network_with_tor/comment_2_8180e202fc493ad07999a3367ccd9425._comment Normal file
View file

@ -0,0 +1,15 @@
[[!comment format=mdwn
username="joey"
subject="""comment 2"""
date="2017-03-02T17:24:23Z"
content="""
@dvicory if someone only knows the onion service address, they can do
nothing to your repository except connect to it and get rejected
due to failure to authenticate. They need the authentication data too
in order to do any of those things. That was talking about the
addresses generated by `git annex peer --gen-addresses`,
which include authentication data.
I've improved the wording to avoid confusion between git-annex's addresses
and onion addresses.
"""]]