Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git: Malicious repositories can execute remote code while cloning

openwall.com

Post reply on HN
Print view View original

71–80 of 228 posts

Re: Git: Malicious repositories can execute remote code while cloning

#71

Post by anaisbetts »

SilverRed wrote: post #50
jonas21 wrote: post #49

Earlier quoted context omitted.

Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.

And use git LFS and cloned a malicious repo? This bug has probably not affected a single user.

Many Git distributions come with git-lfs installed by default

Re: Git: Malicious repositories can execute remote code while cloning

#73

Post by scubbo »

bluejekyll wrote: post #68
rileymat2 wrote: post #64

Earlier quoted context omitted.

Minor quibble, it should be the three hardest problems.

It should be, but the increments were run in parallel on nonvolatile memory.

The two hardest problems in computer science are:

1) Naming 3) Cache Invalidation 2) Off-by-one errors 3) In-order once-only delivery of distributed messages

And an almost fanatical devotion to the Pope

Re: Git: Malicious repositories can execute remote code while cloning

#74

Post by trollian »

jonas21 wrote: post #49
caslon wrote: post #41

> This vulnerability affects platforms with case-insensitive filesystems with support for symbolic links, when certain clean/smudge filters are configured globally (e.g. Git LFS). Can we get the title changed to "on macOS and Windows?" I was worried for a second, but this is meaningless.

Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.

I would assume that most people developing on macOS have configured case sensitive filesystems. And does Windows do symlinks now?

Seems like a weird edge case to me. I guess Apple and Microsoft should push out OS updates to cover it.

Re: Git: Malicious repositories can execute remote code while cloning

#76

Post by hesdeadjim »

Ancapistani wrote: post #69
xarope wrote: post #38

Earlier quoted context omitted.

I thought the two hardest problems were: 1) naming 2) cache invalidation ... 3) off-by-one errors

I'm pretty sure it's: 1) naming 4) concurr2) cache invalidationency ... 3) off-by-one errors

Love this.

Re: Git: Malicious repositories can execute remote code while cloning

#77

Post by bouncycastle »

segfaultbuserr wrote: post #30
stefan_ wrote: post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

Difficult problems in programming: (1) cache invalidation (2) off-by-one errors

shouldn't your list start from 0?
Post reply on HN