When we launched Projects we decided to play safe and configured the Web server and access to all repositories over SSL. Some users have expressed interest in Git over SSH, other users have mentioned how SSL is not a requirement to them and would be happy with normal HTTP.
We started working on our server configuration, but decided that we wanted to allow everyone to decide for himself. We configured Projects so that everything is enabled by default, but project owners are free to configure and limit which protocols can be used to access the resources of a project.
Similarly to the Web site, all repositories can now be accessed both via HTTP and HTTPS. If you had issues with Git over HTTPS in the past you can now remove SSL and avoid recompiling your libraries. If you like SSH better, don’t forget to read how to use Git over SSH in Projects. Last but not least, the WebDAV server can now be accessed with or without SSL.
If you are working in the Open Source you probably don’t worry about protecting your files and using HTTP might be a better option than HTTPS. Please note that when authenticating over HTTP, your password will be sent in clear and a man-in-the-middle might still try to steal it.
A project owner can control which protocols are enabled by visiting the Admin tab and then clicking on Protocols. By default they are all enabled. If you are concerned about security, disable HTTP.
This is how it looks in one of my projects, where I have disabled all HTTP access to Git and only allow HTTPS for WebDAV:
As a user you can choose which protocol you want to use when checking out or cloning a repository. To make life easier we changed the source page a little bit. See how now there are two buttons to choose the protocol you want to use. These change based on the repository type and available protocols.
The same applies to the Files section and the WebDAV protocol.