Re: Git cvsserver serious issue

Andrew Dunstan <andrew@dunslane.net> writes:
>> On Thu, Sep 23, 2010 at 17:16, Tom Lane<tgl@sss.pgh.pa.us>  wrote:
>>> I'm still wondering why we don't simply lobotomize git-cvsserver to
>>> refuse requests to check out anything except the active branch tips.

> Are we sure that's going to stop the DOS issue?

The claimed denial of service is that each checkout target requires a
separate SQLite database.  Limit the number of checkout targets accepted
and you're done.  Or at least, if you're not done, it behooves those
claiming there's a security problem to show what the problem is.  It's
not like this piece of software isn't used in production, so I doubt
it needs to be babied quite as much as this thread is assuming.
        regards, tom lane