Live data from Hacker News

Git: Malicious repositories can execute remote code while cloning

openwall.com

211–220 of 228 posts

Re: Git: Malicious repositories can execute remote code while cloning

#211
post #173
post #131

Earlier quoted context omitted.

And the guy who announced the new Git release works for Google, but uses his pobox.com email for Git development.

Yes, actually, Googlers are encouraged to use their personal Github accounts.

That is true but the git release has nothing to do with GitHub accounts.

Re: Git: Malicious repositories can execute remote code while cloning

#212
post #209

Earlier quoted context omitted.

every UNIX and POSIX system that has been well-designed Case sensitivity wasn’t designed; the first Unix couldn’t spare the CPU cycles to do case insensitive matching, which was the norm at the time.

And yet nearly every UNIX system that was well-designed isn't case insensitive. I was pointing out correlation, not causation.

How many case-insensitive UNIX systems are there? I’m not sure you have enough data points here. :P

Re: Git: Malicious repositories can execute remote code while cloning

#213
post #193

Earlier quoted context omitted.

Technically yes, but I can’t think of the last time I cloned a repo without then running code from it...

Any html/js web frontend project that runs in a browser?

Sure I'll just `npm install`.... damnit! Hacked again.

Re: Git: Malicious repositories can execute remote code while cloning

#214

Earlier quoted context omitted.

The fact that Linux is case-sensitive is the egregious crime. It's a nasty holdover from circa-1970 Unix when case-folding was an expensive operation.

Case-senitivity is not a "nasty holdover", it is a good design decision that continues to be proven correct (case in point, this bugfix for case-insensitive filesystems). Why would you introduce complexity into the filesystem to try to normalize file names when you can simply, not? I mean, have you _seen_ the mess that is Unicode normalization? Hundreds of different glyphs or whatever that are all considered equivale…

It bugs me to see foo.c and Foo.c as separate files in a directory listing. I like the fact that MacOS doesn't allow this situation to ever happen. Not taking on that problem means it's left to the user to figure out what's going on when similar glyphs occur.

Re: Git: Malicious repositories can execute remote code while cloning

#215

Earlier quoted context omitted.

The two most difficult ones are naming things, cache invalidation, and off-by-one errors. HTH. ;)

I prefer the ordered version. three most difficult things in CS: 2) Naming Things 1) Cache Invalidation 4) off by one errors 3) Concurrency

two most difficult things in CS:

0) naming things

1) cache invalidation

42) asynchronous callbacks

2) off by one errors

Re: Git: Malicious repositories can execute remote code while cloning

#216
post #190
post #63

Earlier quoted context omitted.

It’s actually the hardest one of the three, being outside the grasp of formal methods.

I really have to disagree, why can't you devise a formal method? - a good name should be descriptive - avoid being overly clever, call a spade a spade - don't optimise for generalisation, naming things is a time to be specific - aim for short but not at the expense of losing context - avoid redundancy in naming of things nearby, leverage spatial context - avoid qualifiers or type information where possible - type sho…

Those aren’t formal definitions. “Formal” means, at the very least, that the specification is done in a formal language, and usually that conformance to the specification can be checked mechanically, that is, by a computer.

https://en.m.wikipedia.org/wiki/Formal_methods

Re: Git: Malicious repositories can execute remote code while cloning

#217
post #17

The commit that fixes this issue: https://github.com/gitster/git/commit/684dd4c2b414bcf648505e... (Surprise, the root cause is a cache )

It's amazing how often exploits come down to optimizations. The general form being "the domain logic is X, and is secure, but we faked around it in this one case to make it faster, and it turns out we made a bad assumption while doing so". Meltdown fits this description too.

Same with bugs. Hate to be the mantra guy but:

1. Make it work

2. Make it right

3. Make it fast (make sure you need to) a.k.a. optimize

4. Make it scale

Re: Git: Malicious repositories can execute remote code while cloning

#218

Earlier quoted context omitted.

Ashamed to admit (as an OSX user) that I didn't even realize the FS was case-insensitive (having migrated from years of Linux usage to a non-Linux desktop). It does a good job of hiding this from the user (filenames are still listed with cases, and bash autocompletion completes to the correct case as well)

MacOS by default uses a "case-preserving case-insensitive" filesystem, so you can create files with mixed case, but you can't create two files with the same name and different case. It's one of MacOS's more-egregious crimes against Unix. Fortunately it doesn't manifest that often, but it rears its head often enough to be a problem.

wasn't this fixed with their new Apple FS?

Wait I'll try

...nope, after `touch makefile` and `touch Makefile`, I still see just `makefile`. OK

Re: Git: Malicious repositories can execute remote code while cloning

#219
post #210

Earlier quoted context omitted.

But probably their work email when doing things on company time?

Nope. This is an example of someone working on company time using their personal email.

Right, which is (AFAIK) not usually recommended except for side projects or ones where there is already an existing relationship under a personal email address.

Re: Git: Malicious repositories can execute remote code while cloning

#220
post #203
post #78

What's an easy way to fix the default git installation on OSX?

I did a `brew install git` and then deleted /Library/Developer/CommandLineTools/usr/bin/git. You can't delete /usr/bin/git even with sudo (system integrity policy). After installing git via brew and removing the one in CommandLineTools, /usr/bin/git is showing the latest version. me@local % git --version git version 2.30.2 I don't know if this is recommended or if it will have negative consequences that i don't know…

I don't use Mac, so I can't speak yo how the changes you made will affect your system. For future reference however, you should know that binaries are searched on your $PATH in order. Instead of deleting anything, you could have edited your $PATH variable so that the directory that brew stores binaries in is searched before other locations.
Post reply on HN