Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git: Malicious repositories can execute remote code while cloning

openwall.com

Post reply on HN
Print view View original

81–90 of 228 posts

Re: Git: Malicious repositories can execute remote code while cloning

#81

Post by jholman »

saganus wrote: post #70
sethammons wrote: post #65

Earlier quoted context omitted.

well played. I think that just got added to my standard vocabulary. Caching has caused more errors and bugs that I've had to deal with than I can recall. My favorite was an off by one error where we returned nicely cached info -- just for the previous user who came through our system! :facepalm: That was a bad one.

Here goes the obligatory > There are only two hard things in Computer Science...

I can never remember what they are, though. To avoid this problem, I think I wrote them down on a post-it, but I had too many post-its on my desk so I got rid of them all, and now I can't remember.

Re: Git: Malicious repositories can execute remote code while cloning

#82

Post by nicklaf »

JBiserkov wrote: post #58
echelon wrote: post #39

Earlier quoted context omitted.

Per your downvotes - I used to hate jokes on Hacker News and downvote them when I saw them, but I've become more ambivalent. They're a way of amicably sharing culture and experiences with other engineers that transcend any differences in age, gender, race, background, etc. The formulation of this joke I tend to see is, The two hardest problems in programming: (1) cache invalidation (2) appropriately naming things (3)…

The two hardest problems in programming: (1) cache invalidation (3) off-by-one errors (2) appropriately naming things (4) parallel execution [leading to race conditions / ordering bugs]

(5) feature creep

Re: Git: Malicious repositories can execute remote code while cloning

#83

Post by joubert »

jholman wrote: post #81
saganus wrote: post #70

Earlier quoted context omitted.

Here goes the obligatory > There are only two hard things in Computer Science...

I can never remember what they are, though. To avoid this problem, I think I wrote them down on a post-it, but I had too many post-its on my desk so I got rid of them all, and now I can't remember.

> wrote them down on a post-it

You write it on local media and kept it on-premises?

Cloud is the new thing, I hear.

Re: Git: Malicious repositories can execute remote code while cloning

#88

Post by Ancapistani »

caymanjim wrote: post #12
pcthrowaway wrote: post #8

Earlier quoted context omitted.

Ashamed to admit (as an OSX user) that I didn't even realize the FS was case-insensitive (having migrated from years of Linux usage to a non-Linux desktop). It does a good job of hiding this from the user (filenames are still listed with cases, and bash autocompletion completes to the correct case as well)

MacOS by default uses a "case-preserving case-insensitive" filesystem, so you can create files with mixed case, but you can't create two files with the same name and different case. It's one of MacOS's more-egregious crimes against Unix. Fortunately it doesn't manifest that often, but it rears its head often enough to be a problem.

> Fortunately it doesn't manifest that often, but it rears its head often enough to be a problem.

IIRC, one place where it does rear its head in when a file is renamed in a git commit to a value that downcases to the same value as the prior name. For example `Foo.txt`->`foo.txt`.

I have `core.ignorecase = true` in my `.gitconfig` for this very reason.

Re: Git: Malicious repositories can execute remote code while cloning

#89

Post by btgeekboy »

jhugo wrote: post #79
toomim wrote: post #78

What's an easy way to fix the default git installation on OSX?

Wait for a macOS security update that includes it. If you don’t want to wait, macports and homebrew will both be patched much faster.

Isn't git distributed with the Xcode command line tools?

Re: Git: Malicious repositories can execute remote code while cloning

#90

Post by jrockway »

mateo411 wrote: post #72

I guess I'll have to stop running $ sudo git clone ...

I don't think that smugly not running as root saves normal users; while malware running as your user can't trash your laptop, they can get your Google cookie and read and send emails as you, spend your money, view your private photos, etc.
Post reply on HN