gehaxelt

It would be great if Github and other large providers could start using SSHFP records [0].

[0] https://www.rfc-editor.org/rfc/rfc4255.html

Good points!

I've updated the post.

Thanks!

Yup, you're right on that one.

I don't think I explicitly said that one should use iodine + DoH to bypass captive portals, but sorry if that somehow was implied.

The blogpost was just intended to be an experiment to compare the performance :-)

Hi,

thanks, I've updated the post!

Hey,

I cross-posted the question on SO [0] and got an interesting answer!

[0] https://stackoverflow.com/questions/47351447/how-to-merge-of...

Hi,

I just rechecked with [1] and you seem to be right.

I'll update the blogpost in a second. Thanks for the hint!

[1] https://httpd.apache.org/docs/current/upgrading.html

Hello HN,

here's one of the blogpost's authors. Although it has been a while since we published the blogpost, I'll try to answer any questions or listen to any suggestions.

Hi, one of the authors here.

I knew about dvcs-ripper, but thought that implementing another variant might be fun and let me learn about git internals.

Does a simple `git clone` really work? I just tested it and it failed:

``` $> git clone http://x.domain.tld/ fatal: repository 'http://x.domain.tld/' not found

$> git clone http://x.domain.tld/.git/ fatal: repository 'http://x.domain.tld/.git/' not found ```

And yes, the post's background is a CTF challenge that blocked a simple `git clone`.

Nice catch :)

I thought the the amount of forks and stars warrants a short writeup.

The script seems to ship with a rundimentary webserver by default, so I don't see a reason to wrap gunicorn et al. around it?

However, you're right that overwriting the source is a possible attack vector.

Hi,

I asssumed that the script would not be restarted, but you're totally right.

Thanks for the comment :)