Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git security vulnerability announced

github.blog

Post reply on HN
Print view View original

141–150 of 302 posts

Re: Git security vulnerability announced

#141

Post by SpicyLemonZest »

ineptech wrote: post #118
wolfgang42 wrote: post #94

Earlier quoted context omitted.

Yeah, dang updated the link: https://news.ycombinator.com/item?id=31010550 (it was previously https://github.com/git/git/commit/8959555cee7ec045958f9b6dd6... )

Thank you, I was confused. I'm very curious if the people complaining about this change as being too paternalistic still feel that way after reading the full disclosure link.

Even after reading the full disclosure link, I'm pretty surprised to learn that a security boundary was intended here. I thought it was common knowledge that git did an uncontrolled search up the filesystem for a .git file, and it would never have occurred to me to run git on a machine where people I don't trust have write access.

Re: Git security vulnerability announced

#142

Post by pvg »

Dylan16807 wrote: post #138
pvg wrote: post #133

Earlier quoted context omitted.

The official announcement tells your that there's a vuln, it's considered important enough to break things and that it's out right now. The other thing tells you someone committed something a few weeks ago. The missing context also helps drive a lot of under-informed grumpy threads, rather than bettter-informed grumpy comments/threads. There'd have probably been fewer grumpy threads with the better link.

They both say right at the top that it's a vulnerability, and the old title put the breakage front and center. So I don't know what you mean by missing context.

The context of one is 'someone committed a thing a few weeks ago and it does a thing, according to someone posting to HN'. The context of the other is 'one of the biggest git users on the planet tells you there's git vuln, fix out right now'.

Re: Git security vulnerability announced

#143

Post by Dylan16807 »

pvg wrote: post #142
Dylan16807 wrote: post #138

Earlier quoted context omitted.

They both say right at the top that it's a vulnerability, and the old title put the breakage front and center. So I don't know what you mean by missing context.

The context of one is 'someone committed a thing a few weeks ago and it does a thing, according to someone posting to HN'. The context of the other is 'one of the biggest git users on the planet tells you there's git vuln, fix out right now'.

Git itself removing an ability should tell you that it's a big deal even more than "one of the biggest git users on the planet".

And again, first line says it's a vulnerability. "it does a thing, according to someone posting to HN" is a big fat strawman.

Re: Git security vulnerability announced

#144

Post by haolez »

zionic wrote: post #77
jra_samba wrote: post #53

is_path_owned_by_current_uid(const char *path) isn't symlink safe given a multi-component path. Symlinks, the poisonous gift that keeps on giving.

I’d love an OS that didn’t even support those.

I think that was one of Plan9's selling points.

Re: Git security vulnerability announced

#145

Post by db48x »

saagarjha wrote: post #125
db48x wrote: post #70

Earlier quoted context omitted.

On the one hand I agree with you; on the other hand that would entail enumerating all possible unsafe configurations. In general when designing a security measure you never want to try to enumerate everything that could be unsafe, because there is always an attacker who is more clever than you are who will think of something you left off the list.

Yes, but I feel like the other thing you need to keep in mind here is that this is going to be a massive pain for a lot of people, and they might end up doing things that are substantially worse for security, like refusing to update their git.

It’s possible, but I doubt it. 99% of people use a personal computer with just a single user account on it (or they use a phone with no git client, so let’s just think about git users for now). With only one real user account on the machine they are not very likely to encounter this security measure.

Re: Git security vulnerability announced

#146

Post by zmmmmm »

And .... there go probably tens of thousands of person-hours of human effort due to fixing this across huge numbers of systems.

It's fascinating to me that we have people out there just casually making these kind of decisions with enormous cost implications with barely any thought to the downstream implications. Then meanwhile, we need approval in our org to claim a $30 taxi voucher as an expense.

Re: Git security vulnerability announced

#147

Post by rectang »

zmmmmm wrote: post #146

And .... there go probably tens of thousands of person-hours of human effort due to fixing this across huge numbers of systems. It's fascinating to me that we have people out there just casually making these kind of decisions with enormous cost implications with barely any thought to the downstream implications. Then meanwhile, we need approval in our org to claim a $30 taxi voucher as an expense.

It boggles the mind that someone thinks security decisions like these are made casually.

Staying sane as an open source maintainer means ignoring such thanklessness as best you can.

Re: Git security vulnerability announced

#148

Post by pvg »

Dylan16807 wrote: post #143
pvg wrote: post #142

Earlier quoted context omitted.

The context of one is 'someone committed a thing a few weeks ago and it does a thing, according to someone posting to HN'. The context of the other is 'one of the biggest git users on the planet tells you there's git vuln, fix out right now'.

Git itself removing an ability should tell you that it's a big deal even more than "one of the biggest git users on the planet". And again, first line says it's a vulnerability. "it does a thing, according to someone posting to HN" is a big fat strawman.

It's really more of a Stay-Puft Marshmallow Man.

Re: Git security vulnerability announced

#149

Post by tgsovlerkhgsel »

zmmmmm wrote: post #146

And .... there go probably tens of thousands of person-hours of human effort due to fixing this across huge numbers of systems. It's fascinating to me that we have people out there just casually making these kind of decisions with enormous cost implications with barely any thought to the downstream implications. Then meanwhile, we need approval in our org to claim a $30 taxi voucher as an expense.

Are you talking about stuff getting broken by this fix, or the patching effort required?

This is relatively low risk so I would expect the mitigation to consist of "let your existing automation update it".

Re: Git security vulnerability announced

#150

Post by JetAlone »

bloaf wrote: post #34

Deep inside some large enterprise company: Jr Engineer: "Hey, I know we've always managed our little dotnet application via email and shared-network-drive, but I've been reading about a thing called "git" that we should probably use." Sr Engineer: "Change is scary and bad, also we are not a software company. We're not going to learn some newfangled whatsit. Just email me the .vba files when you want me to review the…

I can relate to both of the engineers in this puppet theater.
Post reply on HN