91–100 of 191 posts
Earlier quoted context omitted.
brew update will use `git clone`, so yeah...
If you read the blog post, GitHub has checked all their repos for for this exploit and is blocking it on pushes; cloning from GitHub should be safe.
Anybody have an idea when SourceTree will have an update?
I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]: > A big "thanks!" for bringing this issue to us goes to our friends in the Mercurial land, namely, Matt Mackall and Augie Fackler. It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor. This doesn't seem like a high prio…
It's a very high priority, because there are things that transparently use Git and don't host all their repositories on Github. Update ASAP.
Link to the patch that fixed it: https://github.com/git/git/commit/cc2fc7c
It's more than just that. There are a number of additional checks that are performed for the benefit of various insane filesystems like HFS and NTFS. For example: HFS has several codepoints that are ignored for the purposes of name comparison; for example, U+200C. We need to protect against those, too, or else you could have ".git /config" in your repository that maps to ".git/config".
Homebrew just updated ( https://github.com/Homebrew/homebrew/pull/35105 ), so Homebrew users should be covered by brew update && brew upgrade git
Make sure you're not using Apple Git (/usr/bin/git); I renamed mine.
Earlier quoted context omitted.
Well, to be clear, this only affects Mac and Windows, correct? (Technically any case changing os) So, update no matter what, unless you're not on an affected system? (this is a question, not a statement)
OK, just so everyone is up to speed: Under what circumstances could a Linux filesystem be case-insensitive? I know of three: FAT (specifically vfat, these days), JFS with Option -O, and CIOPFS (Case Insensitive On Purpose Filesystem): http://superuser.com/questions/290480/case-insensitive-parti... http://linux.die.net/man/8/mkfs.jfs http://manpages.ubuntu.com/manpages/hardy/man8/jfs_mkfs.8.ht... http://www.brain-dump…
There are others that would be exotic these days, like AFP. And with FUSE, could be anything.
Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows. Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain…
I just downloaded git from git-scm.org and I only got 2.0.1. :/
I am running OSX Yosemite. ➜ ~ git --version git version 1.9.3 (Apple Git-50) When I navigate to http://git-scm.com/download/mac it downloads 2.0.1 which was released on 6/29/14. How can I upgrade to 1.9.5?
also: https://stackoverflow.com/questions/19109542/installing-late...
I always get a strange, uneasy feeiling when the tin foil hats turn out to be right.
I wonder if they are right on GPG, too. For those who don't know this: The OpenBSD people refuse to sign their releases with that "far too complex" GPG tool, but created their own lightweight "signify" tool instead. [1]