Live data from Hacker News

Git security vulnerability announced

github.blog

41–50 of 302 posts

Re: Git security vulnerability announced

#41
post #30

Earlier quoted context omitted.

That does seem like a mistake, upon a cursory examination.

I submitted a PR on github https://github.com/git/git/pull/1235 . Supposedly there's a bot who will send an email, but I don't have permissions to use it... mhm...

Fun :)

Going to send an email the old–fashioned way?

Re: Git security vulnerability announced

#42
post #34

Deep inside some large enterprise company: Jr Engineer: "Hey, I know we've always managed our little dotnet application via email and shared-network-drive, but I've been reading about a thing called "git" that we should probably use." Sr Engineer: "Change is scary and bad, also we are not a software company. We're not going to learn some newfangled whatsit. Just email me the .vba files when you want me to review the…

Time to preemptively post this to StackOverflow and self-solve the question for some of that sweet sweet StackOverflow rep. jk

Re: Git security vulnerability announced

#43
post #34

Deep inside some large enterprise company: Jr Engineer: "Hey, I know we've always managed our little dotnet application via email and shared-network-drive, but I've been reading about a thing called "git" that we should probably use." Sr Engineer: "Change is scary and bad, also we are not a software company. We're not going to learn some newfangled whatsit. Just email me the .vba files when you want me to review the…

The premise of this story is one I lived. I was a web dev intern for a local government office and they actually emailed each other zips of dotnet apps.

The only difference is that my git pitch went really well and they promised they would start using it. They never started using it.

Re: Git security vulnerability announced

#45
post #41

Earlier quoted context omitted.

I submitted a PR on github https://github.com/git/git/pull/1235 . Supposedly there's a bot who will send an email, but I don't have permissions to use it... mhm...

Fun :) Going to send an email the old–fashioned way?

Gonna beg in the irc channel for git so they give me access to that bot. God forbid I have to format a patch the way they want me to

Re: Git security vulnerability announced

#47
post #34

Deep inside some large enterprise company: Jr Engineer: "Hey, I know we've always managed our little dotnet application via email and shared-network-drive, but I've been reading about a thing called "git" that we should probably use." Sr Engineer: "Change is scary and bad, also we are not a software company. We're not going to learn some newfangled whatsit. Just email me the .vba files when you want me to review the…

[deleted]

Re: Git security vulnerability announced

#50

Earlier quoted context omitted.

Maybe it's intended? If you specify a directory for something in your git config it sounds reasonable to assume you trust it. That said, if it is intended, I'm surprised there isn't a comment mentioning that because it certainly looks like a bug.

I considered that too... but not sure. There's also the fact that it'll reset is_safe to 0 on each config line... which is likely not intended. Seems like a rushed patch. Unless I'm seriously misunderstanding how that read_very_early_config function works (it calls the cb for each key-value pair in the config, I'm assuming).

It does. In fact every time that function is called it completely reparses all the config files. That seems like a really weird choice to me, since there are dozens of functions that do this to check individual settings, but I guess in practice it’s not really that slow.
Post reply on HN