Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git security vulnerability announced

github.blog

Post reply on HN
Print view View original

191–200 of 302 posts

Re: Git security vulnerability announced

#191

Post by leni536 »

berkes wrote: post #177
everybodyknows wrote: post #152

Earlier quoted context omitted.

Can you say what Linux distro does this? Seems like very poor taste for a command shell to be assuming one particular SCM.

On Ubuntu, and I presume therefore many debian derivatives and debian itself, `apt get git` will install a file called `/usr/lib/git-core/git-sh-prompt` (dpkg -S /usr/lib/git-core/git-sh-prompt). This script allows you to see repository status in your prompt. It comes with 5 utility functions that AFAIKS are usable in all common shells: __git_ps1_show_upstream () __git_ps1_colorize_gitstring () __git_eread () __git_s…

This feels like tab completion is a more serious attack vector then?

Re: Git security vulnerability announced

#192

Post by leni536 »

Too wrote: post #132
teruakohatu wrote: post #62

Earlier quoted context omitted.

Couldn't that be mitigated by git adding a --readonly option that prevents any write operations? Then just use that option for any PS1 executables?

core.fsconfig is supposed to be read only, but since it’s an external process, git doesn’t know what really happens in there, so it can’t propagate any —-readonly enforcement.

That's where some sandboxing could help, maybe.

Re: Git security vulnerability announced

#193

Post by beermonster »

tommiegannert wrote: post #178

> Run the uninstaller under an administrator account rather than as the SYSTEM user How do I run something as SYSTEM? I thought I always ran as "me" or Administrator. Is this only likely to happen for deployment automation tools? > Avoid running the uninstaller until after upgrading Don't leave us with this cliff-hanger... Does the upgrade installer run the uninstaller first? (The original report doesn't have this bu…

You can run it using something like psexec sysinternals tool or Process Hacker. But it’s not something someone would likely do by accident and it’s a bit orchestrated/non-obvious.

Re: Git security vulnerability announced

#194

Post by leni536 »

zeroimpl wrote: post #7
rst wrote: post #2

Well, depending on exactly how much this blocks, this could get pretty awkward -- typing 'git log' in a repo owned by someone else can be awfully handy, even if file system permissions block changing it at all, and putting together a list of all places you might want to do this in advance could get pretty awkward. (Not running hooks, or allowing operations that would trigger them, from non-owned directories would pre…

Yes I’ve run “git status”, “git log” and “git diff” on other people’s repo’s plenty of times to help debug things, so it’d be sad to see this stop working. It seems some basic readonly operations should still be supported.

Maybe the pragmatic way from now on is to clone the repo, even if it's on the local machine.

Re: Git security vulnerability announced

#195

Post by faho »

alophawen wrote: post #171
nodesocket wrote: post #170

Will Ubuntu update to v2.35.2? My current install is using the elder v2.25.1: ubuntu@vpn1:$ git --version git version 2.25.1 ubuntu@vpn1:$ cat /etc/os-release NAME="Ubuntu" VERSION="20.04.4 LTS (Focal Fossa)" ID=ubuntu ID_LIKE=debian PRETTY_NAME="Ubuntu 20.04.4 LTS" VERSION_ID="20.04" HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_…

Since the security bug is windows-specific, you could play it cool.

It's not windows-specific. It's just that the git-for-windows people are more receptive to the idea of this being a security bug.

The behavior is cross-platform.

Re: Git security vulnerability announced

#196

Post by jyrkesh »

asvitkine wrote: post #136
edgyquant wrote: post #110

Earlier quoted context omitted.

The default shell on Mac and a lot of Linux distros do this installation, as well as git for windows.

Can you explain? A shell isn't supposed to be installing things on it's own... (Assuming you're talking about zsh or bash when you say shell.)

There's a lot of different ways to install Git on a lot of different OSes, and some of them put helper shell scripts down by default.

Re: Git security vulnerability announced

#197

Post by 1123581321 »

rvwaveren wrote: post #175

Question for Mac users. Apple installs git with its command line tools and is currently at version 2.32. Is it wise to install git via Homebrew so that you can upgrade faster? Or are there some benefits from apple-git?

I’m not aware of any benefit to using the system git, as a user.

Re: Git security vulnerability announced

#198

Post by rswail »

rvwaveren wrote: post #175

Question for Mac users. Apple installs git with its command line tools and is currently at version 2.32. Is it wise to install git via Homebrew so that you can upgrade faster? Or are there some benefits from apple-git?

I use the macports version. As far as I am aware, there are no advantages to using the Apple version.

Re: Git security vulnerability announced

#199

Post by rswail »

alkonaut wrote: post #162

Don’t make tools use processes for “plug-in behavior”. Do one thing and do it well doesn’t really appeal to me to begin with but “let the first thing do the next thing on its own” is definitely a bastardization of that idea as well. Git has that Unix disease where the go to method of getting anything user configurable done with one program is launching another program . I’d much rather use tools that use huge convolu…

> I’d much rather use tools that use huge convoluted script languages or good plug-in apis than tools that duct tape together with exit codes.

The Unix "plug-in API" is pipes and exec and "everything is a file (descriptor)". A "good plug-in API" that doesn't support anything written outside the "huge convoluted script language" is not a plug-in API, it's an internal API of the "convoluted script language".

"Do one thing and do it well doesn’t really appeal to me to begin with" means that you don't like the Unix model in general.

Re: Git security vulnerability announced

#200

Post by rswail »

saagarjha wrote: post #51
bin_bash wrote: post #18

Doesn’t homebrew typically get setup as a different user? How’s that going to work?

Homebrew typically changes the ownership of the directory to the current account.

Homebrew's mecahnisms are inherently "fail-unsafe". It really has no excuse.
Post reply on HN