Yes, that problem persists. No you would never push to the automatically fetched dependencies. I guess I could setup my machine to allow password-less git clone/pull with ``https://`` also. I think in the future it would be nice to even support dependencies that require a specific protocol or at least which have different protocols. I see that it is inconvenient to use the parents protocol if you have a parent which is not on e.g. github. So we could replace the ``fatal(...)`` with a default to ``https://`` and then make a warning in the log.