Times like this i'm glad i'm still on Mercurial (no `strcpy` overflows in Python). Is anyone planning on writing a DVCS in Rust?
Yes, pijul: https://pijul.org/
Server and Client RCE in Git version 2.7.1 and below
21–30 of 30 posts
Re: Server and Client RCE in Git version 2.7.1 and below
#22Times like this i'm glad i'm still on Mercurial (no `strcpy` overflows in Python). Is anyone planning on writing a DVCS in Rust?
It wouldn't have to be a new DVCS. It could be a Rust implementation of Git. e.g. Java Git implementation (JGit) used by Eclipse, Gerrit, etc.
Re: Server and Client RCE in Git version 2.7.1 and below
#23Times like this i'm glad i'm still on Mercurial (no `strcpy` overflows in Python). Is anyone planning on writing a DVCS in Rust?
It wouldn't have to be a new DVCS. It could be a Rust implementation of Git. e.g. Java Git implementation (JGit) used by Eclipse, Gerrit, etc.
Pijul, linked in a sibling comment, appears to actually be a Rust implementation of Darcs (or at least inspired by it).
Re: Server and Client RCE in Git version 2.7.1 and below
#24Earlier quoted context omitted.
But a fix should come via the normal update channel soon? I'm on wily, should I expect to add this PPA or risk vulnerability?
Ubuntu should announce the fix at https://www.ubuntu.com/usn/ but I can't load the page right now. (removed DSA link as per advice below)
https://bugs.launchpad.net/ubuntu/+source/git/+bug/1557787 is the tracking bug for this issue. Seems like it's fixed on xenial but not yet in older releases.
Re: Server and Client RCE in Git version 2.7.1 and below
#25Note: if you're using Ubuntu, there is a semi-official PPA that has a non-vulnerable version (2.7.3): https://launchpad.net/~git-core/+archive/ubuntu/ppa
But a fix should come via the normal update channel soon? I'm on wily, should I expect to add this PPA or risk vulnerability?
Unfortunately it looks like the distros have not been particularly diligent about releasing a fix via the security channel (according to the article), so this PPA is a workaround
Re: Server and Client RCE in Git version 2.7.1 and below
#26Earlier quoted context omitted.
It wouldn't have to be a new DVCS. It could be a Rust implementation of Git. e.g. Java Git implementation (JGit) used by Eclipse, Gerrit, etc.
Pijul, linked in a sibling comment, appears to actually be a Rust implementation of Darcs (or at least inspired by it).
Pijul is not a reimplementation of darcs, it's based on a new theory, without the performance drawbacks of darcs.
Btw, rewriting darcs would really feel like reinventing the wheel. Haskell is safe and great already.
Re: Server and Client RCE in Git version 2.7.1 and below
#27Re: Server and Client RCE in Git version 2.7.1 and below
#28Re: Server and Client RCE in Git version 2.7.1 and below
#29Re: Server and Client RCE in Git version 2.7.1 and below
#30BitBucket Cloud is currently on Git 2.1.1.1.g1fb337f (Version Info link in the footer https://bitbucket.org/support). Anyone know what about GitHub?