> Why can’t you just use SSH keys? The wish for automated login without > leaking passwords is exactly the problem they solve. I can and I do. But maybe other users cannot, and they get tempted by that :password bit. Or they like to carry on a stick plink next to their fossil executable, so they are really portable and not depend on the host's software.
By the way: Does the whole reasoning not hold for https URLs? They allow a password on the command line, too. >> remove this altogether from documentation. > Agreed. Was done. The user name is still cut off at a possible colon (now undocumented), but I guess that's ok, given the usual [a-z_][a-z0-9_-]*[$] rule for user names. >> Side note: as for the security risk, I agree in principle, but since the >> user has already decided to type in his password on fossil's command >> line, the evil is there and passing it to plink makes it no worse. > > A password interactively typed into ssh/plink is as secure as the box it’s > running on. My example was for cases where the user does *not* type his password into plink since, well, vanilla plink launched by another process does not prompt for a password - the initial reason for my post. Maybe it is best to mention this issue in the (html) documentation and suggest alternatives, i.e. either use TortoisePlink or plink -i <keyfile> (or Pageant, of course). Daniel _______________________________________________ fossil-users mailing list fossil-users@lists.fossil-scm.org http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
