As dlang said, it's a matter of authentication; how do you know that the repository really belongs to the person named in the pull request?
About http, that's purely a performance thing. The git:// protocol is far more bandwidth-efficient than the git-over-http protocol.
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds