We don't; I regret that "default credentials" suggests that it should be the default.  They really represent the *user's* default, and maybe an intelligent program's default, but probably not the library's default.

There may be some information leakage if you were to send NTLM credentials to an untrusted host; definitely your username and domain, which might be sensitive.

Applications should determine whether it's safe to send this by determining whether the endpoint is trustworthy.  The library should not be involved in this decision.

> On May 1, 2014, at 11:10 PM, nulltoken <notifications@github.com> wrote:
> 
> In LibGit2Sharp.Tests/NetworkFixture.cs:
> 
> > @@ -19,10 +19,12 @@ public void CanListRemoteReferences(string url)
> >  
> >              string repoPath = InitNewRepository();
> >  
> > +            var credentials = new DefaultCredentials();
> I don't think we want to default to DefaultCredentials (here and below) (see #660)
> 
> /cc @ethomson
> 
> —
> Reply to this email directly or view it on GitHub.