Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote code execution, git, and OS X

rachelbythebay.com

Post reply on HN
Print view View original

11–20 of 385 posts

Re: Remote code execution, git, and OS X

#11

Post by atdt »

reedloden wrote: post #2

Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)... Sure, Apple should ship a fix, but there are ways around it for now.

It's a bit too precarious to be an adequate solution, in my opinion. It depends on /usr/local/bin always being ahead of /usr/bin in $PATH, and on scripts never invoking the system git via its full path, and on Homebrew never accidentally uninstalling git due to a botched upgrade. Not to mention the fact that Homebrew itself uses the system git to install itself.

Re: Remote code execution, git, and OS X

#12

Post by bndr »

foota wrote: post #9
bndr wrote: post #7

Why the hate for OS X? Fedora 22 and Fedora 23 have only git 2.4.11 and 2.5.5 in their repositories.

presumably because you can easily update git on Fedora

When I do `dnf update git` I get at most 2.4.11/2.5.5, the only way I can get the latest is to compile from source.

EDIT: OK. So the fixes were backported

Re: Remote code execution, git, and OS X

#13

Post by Someone »

_ZeD_ wrote: post #4

Remember when I said El Capitan? Apple is doing something new which basically keeps you from twiddling certain system-level programs without going to fantastic lengths. Not even root is enough to do it. Can someone explain it to me?

https://support.apple.com/en-us/HT204899, https://en.wikipedia.org/wiki/System_Integrity_Protection, https://derflounder.wordpress.com/2015/10/01/system-integrit...

Re: Remote code execution, git, and OS X

#14

Post by bronxbomber92 »

aorth wrote: post #6
reedloden wrote: post #2

Isn't this why projects such as Homebrew thrive? For me personally, I just `brew install git`, and I keep it updated that way (`brew update && brew upgrade`)... Sure, Apple should ship a fix, but there are ways around it for now.

Yes, indeed, but Mac OS X users who use Homebrew are a subset of all Mac OS X users. The problem is in the default software. Apple's update model isn't good for this type of software, so the fact that it is possible for a user to install secure versions from Homebrew (or compile their own) doesn't matter.

Xcode is distributed and released over the AppStore and can be rev-ed at any frequency, independently of the OS; Apple's update model not does prevent an expedient update.

Perhaps the main cause for delay is the associated QA efforts to make sure that other components in the stack which depend on git don't break in the case that git has broken binary compatibility (i.e. changed its public interface).

Re: Remote code execution, git, and OS X

#15

Post by brightball »

xyzzy123 wrote: post #8
aorth wrote: post #6

Earlier quoted context omitted.

Yes, indeed, but Mac OS X users who use Homebrew are a subset of all Mac OS X users. The problem is in the default software. Apple's update model isn't good for this type of software, so the fact that it is possible for a user to install secure versions from Homebrew (or compile their own) doesn't matter.

Except that git is used specifically by users who are downloading and compiling software.

And at this point the first instruction for any OSX user who downloads and compiles anything is "Install Homebrew"

Re: Remote code execution, git, and OS X

#16

Post by fabulist »

dkopi wrote: post #10

I Clicked on the link expecting to read about a vulnerability. This is actually about blasting OS X for not having updated versions of software. Software updates are super important of course, and apple should be better at pushing the latest software updates, but I wish the title reflected that.

I disagree that it is clickbait. There is a schema people use for announcing security vulnerabilities (" in version through "), and the RCE issue was recent, so to those familiar it was clear that it was exposition rather than disclosure.

For those unfamiliar, now you know

Re: Remote code execution, git, and OS X

#17

Post by bigger_cheese »

bndr wrote: post #7

Why the hate for OS X? Fedora 22 and Fedora 23 have only git 2.4.11 and 2.5.5 in their repositories.

According to https://bodhi.fedoraproject.org/updates/FEDORA-2016-6554eff6...

"Notes about this update: Security fix for CVE-2016-2315, CVE-2016-2324 (by updating to 2.5.5)."

So looks like they have backported the security fixes

Re: Remote code execution, git, and OS X

#19

Post by shirro »

_ZeD_ wrote: post #4

Remember when I said El Capitan? Apple is doing something new which basically keeps you from twiddling certain system-level programs without going to fantastic lengths. Not even root is enough to do it. Can someone explain it to me?

On my Chromebook, a linux system, the root filesystem is mounted read only. To modify a file in /usr/bin I would need to activate developer mode then remount it rw. I expect this is probably something similar and done for similar reasons.

The big market isn't developers but end users who have no idea how to protect themselves from real threats and who don't use git. And for them sandboxing, signed executables, verified boots and other measures make life far better.

If you are a developer using a Mac you most likely use brew or some sort of vm/container system anyway.

Re: Remote code execution, git, and OS X

#20

Post by imron »

dkopi wrote: post #10

I Clicked on the link expecting to read about a vulnerability. This is actually about blasting OS X for not having updated versions of software. Software updates are super important of course, and apple should be better at pushing the latest software updates, but I wish the title reflected that.

> This is actually about blasting OS X for not having updated versions of software.

No it's not, it's blasting OS X for shipping software with a known remote execution vulnerability, and not allowing the user to easily upgrade that software themselves due to new OS-wide security policies.

Post reply on HN