Re: Git cvsserver serious issue

Andrew Dunstan <andrew(at)dunslane(dot)net> writes:
>> On Thu, Sep 23, 2010 at 17:16, Tom Lane<tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>>> I'm still wondering why we don't simply lobotomize git-cvsserver to
>>> refuse requests to check out anything except the active branch tips.

> Are we sure that's going to stop the DOS issue?

The claimed denial of service is that each checkout target requires a
separate SQLite database. Limit the number of checkout targets accepted
and you're done. Or at least, if you're not done, it behooves those
claiming there's a security problem to show what the problem is. It's
not like this piece of software isn't used in production, so I doubt
it needs to be babied quite as much as this thread is assuming.

regards, tom lane