Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git: Malicious repositories can execute remote code while cloning

openwall.com

Post reply on HN
Print view View original

171–180 of 228 posts

Re: Git: Malicious repositories can execute remote code while cloning

#171

Post by [deleted] »

minitech wrote: post #150
kazinator wrote: post #143

Earlier quoted context omitted.

In spite of my tongue-in-cheek statement, I get it. It's huge in the context of non-programming uses of Git. If some people are just sharing some text documents with Git, then it's a big deal. This is likely on the rise. E.g. if you look at a site like Github, there is a lot of non-code content in it. Some people stash that content, and other people believe that content to just be harmless files that will never perpe…

It’s a big deal regardless of whether documents or code are being stored. Cloning a repo should not open you up to RCE.

[deleted]

Re: Git: Malicious repositories can execute remote code while cloning

#172

Post by gdavisson »

bouncycastle wrote: post #77
segfaultbuserr wrote: post #30

Earlier quoted context omitted.

Difficult problems in programming: (1) cache invalidation (2) off-by-one errors

shouldn't your list start from 0?

There are three kinds of programmers:

  1) Those who number lists starting at 1.
  1) Those who number lists starting at 0.
  2.5) Stan Kelly-Bootle, who proposed a compromise.

Re: Git: Malicious repositories can execute remote code while cloning

#173

Post by skzv »

enneff wrote: post #131
de6u99er wrote: post #111

Earlier quoted context omitted.

Strange. The guy who fixed the issue works at Microsoft, but uses his gmx email for Github.

And the guy who announced the new Git release works for Google, but uses his pobox.com email for Git development.

Yes, actually, Googlers are encouraged to use their personal Github accounts.

Re: Git: Malicious repositories can execute remote code while cloning

#174

Post by bryanrasmussen »

jholman wrote: post #81
saganus wrote: post #70

Earlier quoted context omitted.

Here goes the obligatory > There are only two hard things in Computer Science...

I can never remember what they are, though. To avoid this problem, I think I wrote them down on a post-it, but I had too many post-its on my desk so I got rid of them all, and now I can't remember.

this reminds me I was dumpster diving at a place with lots of post-it notes and there was one that said 2HCS => whatchamacallit, CI!

what that you?

on edit: I'm going to let that 'what that you' stand because one of the hardest things about HN posts is grammatical correctitude.

Re: Git: Malicious repositories can execute remote code while cloning

#175

Post by Ygg2 »

Gene_Parmesan wrote: post #169
eru wrote: post #128

Earlier quoted context omitted.

Fortunately, many off-by-one errors can be caught with more ergonomic tooling. For the simplest example: compare the old C-style for loop vs a Python style for-each loop.

I don't find I ever make off-by-one errors with simple collection iteration; at some point "i Oh, and slicing. I will never get Python slicing right the first time. The fact that the range is [begin, end) is just never the way I expect it to work.

But slicing 0..len and for (i=0; iIn [0, len) ')' means less than. As in 0≤ x< len.

Re: Git: Malicious repositories can execute remote code while cloning

#176

Post by csunbird »

Xelbair wrote: post #168
llarsson wrote: post #152

Earlier quoted context omitted.

The two most difficult ones are naming things, cache invalidation, and off-by-one errors. HTH. ;)

I prefer the ordered version. three most difficult things in CS: 2) Naming Things 1) Cache Invalidation 4) off by one errors 3) Concurrency

Another version, about distributed systems:

There are only two hard problems in distributed systems:

2. Exactly-once delivery

1. Guaranteed order of messages

2. Exactly-once delivery

Re: Git: Malicious repositories can execute remote code while cloning

#177

Post by saagarjha »

skzv wrote: post #173
enneff wrote: post #131

Earlier quoted context omitted.

And the guy who announced the new Git release works for Google, but uses his pobox.com email for Git development.

Yes, actually, Googlers are encouraged to use their personal Github accounts.

But probably their work email when doing things on company time?

Re: Git: Malicious repositories can execute remote code while cloning

#178

Post by friendzis »

jtsiskin wrote: post #135
minitech wrote: post #119

Earlier quoted context omitted.

There is a huge difference between “clone a repo” and “clone a repo and run code from it”.

Technically yes, but I can’t think of the last time I cloned a repo without then running code from it...

Depends on how you define "running code".

  1. Download container description (Dockerfile)
  2. Upon image build it "compiles things" (e.g. processes/assembles javascript)
  3. Build fails, because it pulls architecture incompatible library (or does not pull architecture mandated library)
  4. Fix build scripts, rebuild container image
  5. Verify container
  6. Pull repo
  7. Reproduce changes, commit
  8. Push
Nothing apart clone-edit-push happens on the repo. The code can be executed on a remote, hardened, isolated system. With proliferation of containers I guess this scenario will become more and more common among ops people.

Re: Git: Malicious repositories can execute remote code while cloning

#179

Post by memorysafety »

emodendroket wrote: post #96
trollian wrote: post #74

Earlier quoted context omitted.

I would assume that most people developing on macOS have configured case sensitive filesystems. And does Windows do symlinks now? Seems like a weird edge case to me. I guess Apple and Microsoft should push out OS updates to cover it.

Windows has done symlinks (known as "junctions") since Windows 2000, so I guess it's a more recent feature you might not have learned about.

That's a dishonest statement and misrepresents the actual support.

The "junctions" are unusable as "windows symlinks".

For one, you can't create any as a normal non-admin user without specific authorization by default.

Re: Git: Malicious repositories can execute remote code while cloning

#180

Post by VMG »

Wowfunhappy wrote: post #125
fulafel wrote: post #117

Earlier quoted context omitted.

And it can run sudo as your user after you warm it up. Or use any number of frequently disclosed OS vulnerabilities for local privilege escalation.

> And it can run sudo as your user after you warm it up. How is it getting my root password?

it could also alias sudo to some other command
Post reply on HN