Live data from Hacker News

Git client vulnerability announced

github.com

71–80 of 191 posts

Re: Git client vulnerability announced

#72
post #57

Where can I find fixed git-related binaries without having to build from source myself? (Sorry, I'm lazy)

on OSX `brew upgrade git` was enough for me

You may have to do these first:

    sudo mv /usr/bin/git ~/.Trash/git_mac_old
    brew update

Re: Git client vulnerability announced

#73

If you don't want to use homebrew on mac, here is the list of commands I used to upgrade: https://gist.github.com/jazzychad/07c0c6da5709202e8106

Thanks for this. Might want to move the original /usr/bin/git out of the way, rather than outright deleting it, juuuuust in case you end up needing the original binary.

Re: Git client vulnerability announced

#74

Should programs periodically check for critical security fixes, and then refuse to run if the current version is affected? It seems like there are a lot of people who don't really pay attention to social media or other security alert channels, who won't have a clue about the extent of this vulnerability. I'm sure they'd update if they knew "if I clone a malicious repo, I'm toast," but there's no way to inform them ex…

I'm not sure how I feel about programs phoning home like that. I tolerate it with apps, but command line tools ought to be doing their stated function when run.

Re: Git client vulnerability announced

#75
post #8

Homebrew just updated ( https://github.com/Homebrew/homebrew/pull/35105 ), so Homebrew users should be covered by brew update && brew upgrade git

For those of us using macports, the port file was updated an hour ago: https://trac.macports.org/browser/trunk/dports/devel/git/Por...

    sudo port selfupdate
    sudo port upgrade git

    git --version

Re: Git client vulnerability announced

#77
post #10
post #8

Homebrew just updated ( https://github.com/Homebrew/homebrew/pull/35105 ), so Homebrew users should be covered by brew update && brew upgrade git

Make sure you're not using Apple Git (/usr/bin/git); I renamed mine.

Gah. Incidents like this makes me frustrated OS X doesn’t have a solid package manager like APT.

Re: Git client vulnerability announced

#78

I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]: > A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler. It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor. This doesn't seem like a high prio…

More back story: https://twitter.com/indygreg/status/545701974671233024

Re: Git client vulnerability announced

#79

If you don't want to use homebrew on mac, here is the list of commands I used to upgrade: https://gist.github.com/jazzychad/07c0c6da5709202e8106

Thanks for this. Might want to move the original /usr/bin/git out of the way, rather than outright deleting it, juuuuust in case you end up needing the original binary.

/usr/bin/git is usually a soft symlink, so the original binary is still there when you rm the synlink. You can see the actual location by doing

    ls -al /usr/bin/git
If it's not in fact a symlink then yes you should probably rename it to preserve it.
Post reply on HN