> would be super curious to see and hear more about their patch to SSHD

It's based on this patch: https://github.com/wuputahllc/openssh-for-git

Note that since openssh 6.2 you can plug in to sshd for the keys without patching it with the AuthorizedKeysCommand , and there's several utilities around for pulling the authorized keys from LDAP or similar services.

Unfortunately, this doesn't scale, as with the AuthorizedKeysCommand, you are required to output all the keys for that user on stdout. Outputing all of the "git" user's authorized keys lines would be an extremely expensive operation.

From the sshd_config man page: "Specifies a program to be used for lookup of the user's public keys. The program will be invoked with its first argument the name of the user being authorized, and should produce on standard output AuthorizedKeys lines"

Thanks for the link, but the fact it is 6 years old, and comes with warnings such as we’re not expert C hackers makes me very nervous.

That's just the original it is based off. There are a few more recently updated forks floating around also. We maintain ours in house.

Either way, if you want to tinker with opensshd I can recommend it as a starting point. It's very small, readable and easily tweaked.

> As far as I know, it is written in Scala too

Nope, it's all Java. It uses the same stack as our other products.

It shares the standard Atlassian plugin framework, which allows users to write plugins in Scala, but the product itself is all Java.

Citation needed.

'Citation needed' is essentially 'I can't be bothered to Google' however:

Ecuador:

http://www.buzzfeed.com/rosiegray/exclusive-documents-illumi...

China:

http://www.nytimes.com/2013/06/27/world/asia/with-snowden-go...

"Security experts and democracy proponents say that mainland China’s domestic surveillance operations in Hong Kong are far more extensive than the American effort. But those operations have largely disappeared from public discussion as attention has focused on the many details released by Mr. Snowden."

I'm pretty sure he's talking from the user's perspective, not design/implementation.

Eh, I am coming from the perspective of a user, not a VCS developer. I find git repositories way easier to navigate, let alone perform complex operations on, because how they work couldn't make more sense to me.

From a user's perspective, Hg is so limited I consider it basically unusable.

I seem to get my stuff done in either. What's missing for you in hg?

Being an active user of both git and hg, I also can't think of any features I make extensive use of in git (rebase, feature branches, etc) that I can't get with hg. My workflows in both are pretty much the same, just a saner interface on the hg side. If anything, git doesn't have revsets, a really powerful query language you can use to sift through your history - see http://www.selenic.com/hg/help/revsets

rebase -i and add --patch were the dealbreakers

Also I have yet to see a hg tutorial that didn't at some point recommend making a second clone of the repo in order to do something complicated.

Free as in beer.

> I can't be sure they got it right, I'll stick to GitHub

I guess you could just not use the feature and only use git clients. Who cares if the redundant hg clone they keep on their end gets out of sync.