Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote code execution, git, and OS X

rachelbythebay.com

Post reply on HN
Print view View original

111–120 of 385 posts

Re: Remote code execution, git, and OS X

#111

Post by microtonal »

stephenr wrote: post #92
brightball wrote: post #73

Earlier quoted context omitted.

That's kind've harsh. What's the issue? Homebrew was about the best option that's existed on OSX for a few years now I thought...

The dependency management is a joke, compile-by-default means it's slow as hell.

Most commonly-used dependencies are bottled (precompiled) these days.

Re: Remote code execution, git, and OS X

#112

Post by comex »

chris_wot wrote: post #95
benley wrote: post #89

Earlier quoted context omitted.

So ... has anybody actually checked to see if Apple has patched the vulnerability in git without bumping the version number, like pretty much every linux distribution does for their stable releases?

You're joking, right? When I use software and I look at the version number, I like to know that it is what it says it is. If they are going to patch the vulnerability, then I want to know if they have done so. Besides which, this whole question is missing the point somewhat. There is no easy way of updating the system supplied tools like git, even if you wanted to. The latest version of git is v2.8, and I think it wo…

Inability to manually update the copy of a tool located in /usr is par for the course with most Linux distributions - in that case the kernel won't stop you from replacing the files (unless your distro has the root FS mounted RO), but the package manager will typically replace them right back the next time there's a minor update (same for OS X updates pre-SIP), and it's easy to accidentally break things. Instead, the recommended method is to generally install non-distro software in /usr/local or elsewhere and put the location on your PATH. Which, of course, works just as well on OS X, and it's what Homebrew and MacPorts do. I don't see the problem.

Re: Remote code execution, git, and OS X

#113

Post by microtonal »

atdt wrote: post #46
brightball wrote: post #15

Earlier quoted context omitted.

And at this point the first instruction for any OSX user who downloads and compiles anything is "Install Homebrew"

The Homebrew installation process uses the system git.

Yes, but if Homebrew is malicious, you'd have more problems than a specially-crafted repository that exploits a git vulnerability. You are installing something that has all user access rights.

Re: Remote code execution, git, and OS X

#114

Post by comex »

chris_wot wrote: post #104
hrrsn wrote: post #101

Earlier quoted context omitted.

It can be disabled. For regular users without git on their systems, it still makes plenty of sense.

It looks like I need to reboot my machine just to disable it. That's the only info I can see to turn it off - unless I'm missing something?

Yes. This is by design, since the whole point is to defend against malware that has gotten root privileges; requiring recovery mode ensures that the physical user of the computer consents to the change.

Re: Remote code execution, git, and OS X

#115

Post by anu_gupta »

chris_wot wrote: post #104
hrrsn wrote: post #101

Earlier quoted context omitted.

It can be disabled. For regular users without git on their systems, it still makes plenty of sense.

It looks like I need to reboot my machine just to disable it. That's the only info I can see to turn it off - unless I'm missing something?

So reboot your machine and disable it if you want. Aren't you able to do that for some reason?

Re: Remote code execution, git, and OS X

#117

Post by capitalsigma »

madeofpalk wrote: post #42
yelnatz wrote: post #38

Earlier quoted context omitted.

chmod: /Applications/Xcode.app/Contents/Developer/usr/bin/git: No such file or directory I don't have Xcode installed, do I have to install it back to do this?

If you don't have Xcode installed then you don't have git. IIRC, you might have a /usr/bin/git executable but that's not actually git, all it does is shows a GUI that prompts you to install XCode

> IIRC, you might have a /usr/bin/git executable but that's not actually git, all it does is shows a GUI that prompts you to install XCode

wat

Re: Remote code execution, git, and OS X

#118

Post by stephenr »

microtonal wrote: post #111
stephenr wrote: post #92

Earlier quoted context omitted.

The dependency management is a joke, compile-by-default means it's slow as hell.

Most commonly-used dependencies are bottled (precompiled) these days.

Except the dependency management solution is terrible, unless you want to compile everything yourself.

For example: https://github.com/Homebrew/legacy-homebrew/issues/35995

Re: Remote code execution, git, and OS X

#119

Post by stephenr »

anu_gupta wrote: post #107
stephenr wrote: post #92

Earlier quoted context omitted.

The dependency management is a joke, compile-by-default means it's slow as hell.

I look forward to your release of something better

So your world view is that only those with a competing solution are allowed to identify issues in something?

Re: Remote code execution, git, and OS X

#120

Post by bertan »

dchest wrote: post #34
yelnatz wrote: post #31

Earlier quoted context omitted.

How do I replace /usr/bin/git? I got the updated brew version downloaded already.

This is in the linked post. Do this to disable it: sudo chmod -x /Applications/Xcode.app/Contents/Developer/usr/bin/git

  sudo cp /Applications/Xcode.app/Contents/Developer/usr/bin/git /somewhere/to/backup/just/in/case
  sudo rm /Applications/Xcode.app/Contents/Developer/usr/bin/git
  sudo ln -s /usr/local/bin/git /Applications/Xcode.app/Contents/Developer/usr/bin/git
Post reply on HN