Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git: Malicious repositories can execute remote code while cloning

openwall.com

Post reply on HN
Print view View original

51–60 of 228 posts

Re: Git: Malicious repositories can execute remote code while cloning

#51

Post by nicoburns »

chungy wrote: post #47
caslon wrote: post #46

Earlier quoted context omitted.

Yes, but no sensible people use case-insensitivity on Linux, and the amount of other people that do in a relevant context can probably be measured with four digits.

I have case-insensitivity enabled for DOSBox and Wine file systems. I've actually thought about converting my whole $HOME to that way, but I do have a few files that would conflict if I did that. I honestly don't think it's that bad of an idea.

Do you store code in $HOME. If so, I wouldn't recommend it. I have a case-sensitive partition on my macOS machine because I was bitten one too many times by code that worked fine on my development machine (case-insensitive file system) only to fail in production (case-sensitive file system).

Re: Git: Malicious repositories can execute remote code while cloning

#52

Post by jonas21 »

SilverRed wrote: post #50
jonas21 wrote: post #49

Earlier quoted context omitted.

Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.

And use git LFS and cloned a malicious repo? This bug has probably not affected a single user.

Isn't the whole point of announcing security patches so that people can update before they're exploited?

Re: Git: Malicious repositories can execute remote code while cloning

#53

Post by imoverclocked »

Twisol wrote: post #43
echelon wrote: post #39

Earlier quoted context omitted.

Per your downvotes - I used to hate jokes on Hacker News and downvote them when I saw them, but I've become more ambivalent. They're a way of amicably sharing culture and experiences with other engineers that transcend any differences in age, gender, race, background, etc. The formulation of this joke I tend to see is, The two hardest problems in programming: (1) cache invalidation (2) appropriately naming things (3)…

It's barely even a joke to me anymore -- it's just too real for me to laugh. (Cache invalidation is essentially the same problem as managing mutable state -- "Out of the Tar Pit" frames mutable state as either essential or incidental, the latter being rederivable in principle from essential state. Incidental mutable state is no more and no less than a cache, and usually one with an informal and undocumented invalidat…

Humor is often the most efficient way to communicate/accept the truth.

Re: Git: Malicious repositories can execute remote code while cloning

#54

Post by chungy »

nicoburns wrote: post #51
chungy wrote: post #47

Earlier quoted context omitted.

I have case-insensitivity enabled for DOSBox and Wine file systems. I've actually thought about converting my whole $HOME to that way, but I do have a few files that would conflict if I did that. I honestly don't think it's that bad of an idea.

Do you store code in $HOME. If so, I wouldn't recommend it. I have a case-sensitive partition on my macOS machine because I was bitten one too many times by code that worked fine on my development machine (case-insensitive file system) only to fail in production (case-sensitive file system).

That would indeed be one reason (aside from sheer time) I've avoided doing it fully.

Re: Git: Malicious repositories can execute remote code while cloning

#55

Post by waheoo »

xarope wrote: post #38
segfaultbuserr wrote: post #30

Earlier quoted context omitted.

Difficult problems in programming: (1) cache invalidation (2) off-by-one errors

I thought the two hardest problems were: 1) naming 2) cache invalidation ... 3) off-by-one errors

I feel like we should have solved the naming problem as an industry by now.

Alas.

Re: Git: Malicious repositories can execute remote code while cloning

#56

Post by JeremyNT »

caslon wrote: post #46
chungy wrote: post #45

Earlier quoted context omitted.

There are many options for case-insensitivity on Linux. The common one would be FAT, which can't handle symbolic links, so that is moot. There is also ext4 and ZFS that can have case-insensitive modes enabled (they aren't by default), which do support symbolic links. ntfs-3g also has an option to mount as case-insensitive (though said option can actually subtly break access to an NTFS volume, since NTFS itself is alw…

Yes, but no sensible people use case-insensitivity on Linux, and the amount of other people that do in a relevant context can probably be measured with four digits.

I've had git repositories on vfat formatted usb drives before. This isn't something I do with much frequency but it's not that exotic of a use case.

There's also the possibility of a git repo on a SMB share. That's not a use case I have, but it's not too difficult to imagine in a corporate environment.

Re: Git: Malicious repositories can execute remote code while cloning

#57

Post by slavik81 »

stefan_ wrote: post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

They had this bug before in other code unrelated to caching. To me, that suggests a deeper root.

Re: Git: Malicious repositories can execute remote code while cloning

#58

Post by JBiserkov »

echelon wrote: post #39
segfaultbuserr wrote: post #30

Earlier quoted context omitted.

Difficult problems in programming: (1) cache invalidation (2) off-by-one errors

Per your downvotes - I used to hate jokes on Hacker News and downvote them when I saw them, but I've become more ambivalent. They're a way of amicably sharing culture and experiences with other engineers that transcend any differences in age, gender, race, background, etc. The formulation of this joke I tend to see is, The two hardest problems in programming: (1) cache invalidation (2) appropriately naming things (3)…

The two hardest problems in programming:

(1) cache invalidation

(3) off-by-one errors

(2) appropriately naming things

(4) parallel execution [leading to race conditions / ordering bugs]

Re: Git: Malicious repositories can execute remote code while cloning

#59

Post by lifeisstillgood »

JBiserkov wrote: post #58
echelon wrote: post #39

Earlier quoted context omitted.

Per your downvotes - I used to hate jokes on Hacker News and downvote them when I saw them, but I've become more ambivalent. They're a way of amicably sharing culture and experiences with other engineers that transcend any differences in age, gender, race, background, etc. The formulation of this joke I tend to see is, The two hardest problems in programming: (1) cache invalidation (2) appropriately naming things (3)…

The two hardest problems in programming: (1) cache invalidation (3) off-by-one errors (2) appropriately naming things (4) parallel execution [leading to race conditions / ordering bugs]

I think you win a bad in-joke award - the first annual Turing-Dad joke award.

Re: Git: Malicious repositories can execute remote code while cloning

#60

Post by CamJN »

SilverRed wrote: post #50
jonas21 wrote: post #49

Earlier quoted context omitted.

Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.

And use git LFS and cloned a malicious repo? This bug has probably not affected a single user.

The GitHub desktop app configures lfs in your gitconfig automatically, so that adds a lot of users to the vulnerable pool.
Post reply on HN