Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm considering whether to use the built-in hg serve or to bother with configuring it with apache etc. The mercurial server will be potentially running on either Debian or OS X 10.5

My main consideration is security, not performance nor even authentication.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Mercurial has patched two serious vulnerabilities. So if you have updated sense 2008 then you shouldn't worry. From a security perspective I'd worry about OSX it has a poor track record and its memory protection is very primitive. (Especially its ASLR implementation which is a joke.) The Debian 6 built on the FreeBSD kernel is a very good choice. (The Linux version is good too ;)

share|improve this answer

I'm not qualified enough to advise on security, but I can say I've been using http://www.lshift.net/mercurial-server.html which relies on SSH keys for read/write access (which you can control in a granular fashion) and that I'm very happy with it. It's not hard to set up.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.