Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

github/gitlab doesn't mean open source #19

Open
TheAwesome98-Real opened this issue Jan 23, 2025 · 1 comment
Open

github/gitlab doesn't mean open source #19

TheAwesome98-Real opened this issue Jan 23, 2025 · 1 comment

Comments

@TheAwesome98-Real
Copy link

i noticed that the sites that have "this site is open source" in it are only those on github, and i saw in the readme that it also checks for gitlab, but that doesn't mean it's open source. it can be open source on other git forges too. maybe you could add a link or button so the user can check if that page leads to a git forge, since in a lot of cases it does (i'm in communities where people make open source personal websites and use alternate git forges)

@davtur19
Copy link
Owner

I know that there could be other cases where a project is opensource, and at the same time there could be a repo on github/gitlab and not be opensource, however it was much easier to manage just these two sites as the links could be in various formats (https/ssh or pointing to local repos).

Moreover, this way the browser does not make requests to third-party sites that the user does not expect.

For example, the user visits example.com, and so it is implied that the extension can visit example.com/.git/*.

However, if there is an external site such as malicious.com in the .git/config, the user will then be visiting another site without knowing it, which could lead to an information leak or CSRF attack.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants