5 ms·

Yes, indeed, but Mac OS X users who use Homebrew are a subset of all Mac OS X users. The problem is in the default software. Apple's update model isn't good for

by aorth 11y ago

Yes, indeed, but Mac OS X users who use Homebrew are a subset of all Mac OS X users. The problem is in the default software. Apple's update model isn't good for this type of software, so the fact that it is possible for a user to install secure versions from Homebrew (or compile their own) doesn't matter.

xyzzy123 11y ago
Except that git is used specifically by users who are downloading and compiling software.
- brightball 11y ago
  And at this point the first instruction for any OSX user who downloads and compiles anything is "Install Homebrew"
  - stephenr 11y ago
    Except for those who have used it and refuse to use it again. There are prebuilt binaries of up to date git distributed via .pkg. The yeast infection that is Homebrew is unnecessary
    - brightball 11y ago
      That's kind've harsh. What's the issue? Homebrew was about the best option that's existed on OSX for a few years now I thought...
      - stephenr 11y ago
        The dependency management is a joke, compile-by-default means it's slow as hell.
        anu_gupta 11y ago
        I look forward to your release of something better
        stephenr 11y ago
        So your world view is that only those with a competing solution are allowed to identify issues in something?
        deleted 11y ago
        [deleted]
        mwfunk 11y ago
        If you're going to be that snarky and nonconstructive about it, you're going to get snarky and nonconstructive comments back. Or at the very least, you're not going to inspire any thoughtful and interesting observations from anyone.
        danieldk 11y ago
        Most commonly-used dependencies are bottled (precompiled) these days.
        stephenr 11y ago
        Except the dependency management solution is terrible, unless you want to compile everything yourself. For example: https://github.com/Homebrew/legacy-homebrew/issues/35995 https://github.com/Homebrew/legacy-homebrew/issues/35995
      - icedchai 11y ago
        Personally I use MacPorts.
  - atdt 11y ago
    The Homebrew installation process uses the system git.
    - arm 11y ago
      Yep, since Homebrew requires the Xcode Developer Tools to be installed (which of course includes the outdated Git).
    - danieldk 11y ago
      Yes, but if Homebrew is malicious, you'd have more problems than a specially-crafted repository that exploits a git vulnerability. You are installing something that has all user access rights.
    - gpvos 11y ago
      Can you inunstall XCode again once you have installed a compiler, toolchain, and git via Homebrew?
      - matt4077 11y ago
        You can just install the command line tools without xcode. From those tools, most can be replaced with their homebrew versions so you only need them for bootstrapping. But if you want to do hardware- or OS X related development, you will need to keep the tools around. CUDA, for example, needs clang et. all. They don't take much space, though, and the toolchain is treated a bit better by Apple than utilities like git, vim etc.
        gpvos 11y ago
        I don't know about homebrew, but macports has clang and other toolchain stuff, so I think it might be possible to uninstall Xcode after installing all necessary tools through macports?
    - OJFord 11y ago
      You _could_ get recent git by some other means prior to installing homebrew. Anything short of compiling from source wouldn't require ever installing XCLT.
bronxbomber92 11y ago
Xcode is distributed and released over the AppStore and can be rev-ed at any frequency, independently of the OS; Apple's update model not does prevent an expedient update. Perhaps the main cause for delay is the associated QA efforts to make sure that other components in the stack which depend on git don't break in the case that git has broken binary compatibility (i.e. changed its public interface).
- atdt 11y ago
  If things are tied up in QA, that is a problem in and of itself, because relevance is an important quality for a security bugfix to have. If my system is compromised today, it will do me little good that the bugfix Apple ships next month was tested extensively for compatibility with Xcode. It is too late for there to be an expedient update from Apple. The vulnerability was disclosed to oss-security over a month ago, on March 15[0]. SUSE had a patch out the next day[1]. By March 24, Debian, Ubuntu, Red Hat, CentOS and Oracle had all issued fixes.[2] [0]: http://www.openwall.com/lists/oss-security/2016/03/15/5 http://www.openwall.com/lists/oss-security/2016/03/15/5 [1]: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2016-03... [2]: http://www.securitytracker.com/id/1035290 http://www.securitytracker.com/id/1035290
  - bronxbomber92 11y ago
    I should clarify that I don't know why an update hasn't been pushed. I was only speculating why it might be taking so long.
ascagnel_ 11y ago
Git is not part of the default configuration on OS X. You need to install XCode first.
sbuk 11y ago
I'd argue that the the OS X user who use git are a subset of Mac OS X users. In fact, a similar subset to that which uses Homebrew...

by aorth 11y ago

xyzzy123 11y ago

Except that git is used specifically by users who are downloading and compiling software.

brightball 11y ago
And at this point the first instruction for any OSX user who downloads and compiles anything is "Install Homebrew"
- stephenr 11y ago
  Except for those who have used it and refuse to use it again. There are prebuilt binaries of up to date git distributed via .pkg. The yeast infection that is Homebrew is unnecessary
  - brightball 11y ago
    That's kind've harsh. What's the issue? Homebrew was about the best option that's existed on OSX for a few years now I thought...
    - stephenr 11y ago
      The dependency management is a joke, compile-by-default means it's slow as hell.
      - anu_gupta 11y ago
        I look forward to your release of something better
        stephenr 11y ago
        So your world view is that only those with a competing solution are allowed to identify issues in something?
        deleted 11y ago
        [deleted]
        mwfunk 11y ago
        If you're going to be that snarky and nonconstructive about it, you're going to get snarky and nonconstructive comments back. Or at the very least, you're not going to inspire any thoughtful and interesting observations from anyone.
      - danieldk 11y ago
        Most commonly-used dependencies are bottled (precompiled) these days.
        stephenr 11y ago
        Except the dependency management solution is terrible, unless you want to compile everything yourself. For example: https://github.com/Homebrew/legacy-homebrew/issues/35995 https://github.com/Homebrew/legacy-homebrew/issues/35995
    - icedchai 11y ago
      Personally I use MacPorts.
- atdt 11y ago
  The Homebrew installation process uses the system git.
  - arm 11y ago
    Yep, since Homebrew requires the Xcode Developer Tools to be installed (which of course includes the outdated Git).
  - danieldk 11y ago
    Yes, but if Homebrew is malicious, you'd have more problems than a specially-crafted repository that exploits a git vulnerability. You are installing something that has all user access rights.
  - gpvos 11y ago
    Can you inunstall XCode again once you have installed a compiler, toolchain, and git via Homebrew?
    - matt4077 11y ago
      You can just install the command line tools without xcode. From those tools, most can be replaced with their homebrew versions so you only need them for bootstrapping. But if you want to do hardware- or OS X related development, you will need to keep the tools around. CUDA, for example, needs clang et. all. They don't take much space, though, and the toolchain is treated a bit better by Apple than utilities like git, vim etc.
      - gpvos 11y ago
        I don't know about homebrew, but macports has clang and other toolchain stuff, so I think it might be possible to uninstall Xcode after installing all necessary tools through macports?
  - OJFord 11y ago
    You _could_ get recent git by some other means prior to installing homebrew. Anything short of compiling from source wouldn't require ever installing XCLT.

bronxbomber92 11y ago

Xcode is distributed and released over the AppStore and can be rev-ed at any frequency, independently of the OS; Apple's update model not does prevent an expedient update. Perhaps the main cause for delay is the associated QA efforts to make sure that other components in the stack which depend on git don't break in the case that git has broken binary compatibility (i.e. changed its public interface).

atdt 11y ago
If things are tied up in QA, that is a problem in and of itself, because relevance is an important quality for a security bugfix to have. If my system is compromised today, it will do me little good that the bugfix Apple ships next month was tested extensively for compatibility with Xcode. It is too late for there to be an expedient update from Apple. The vulnerability was disclosed to oss-security over a month ago, on March 15[0]. SUSE had a patch out the next day[1]. By March 24, Debian, Ubuntu, Red Hat, CentOS and Oracle had all issued fixes.[2] [0]: http://www.openwall.com/lists/oss-security/2016/03/15/5 http://www.openwall.com/lists/oss-security/2016/03/15/5 [1]: http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2016-03... [2]: http://www.securitytracker.com/id/1035290 http://www.securitytracker.com/id/1035290
- bronxbomber92 11y ago
  I should clarify that I don't know why an update hasn't been pushed. I was only speculating why it might be taking so long.

ascagnel_ 11y ago

Git is not part of the default configuration on OS X. You need to install XCode first.

sbuk 11y ago

I'd argue that the the OS X user who use git are a subset of Mac OS X users. In fact, a similar subset to that which uses Homebrew...