3 ms·

The stars don't really have to be aligned: any script could invoke system git directly.

• matt4077 10y ago
  Yeah, but a script that intentionally invokes /usr/bin/git has already achieved the non-privileged access the git vulnerability could provide. A script that unintentionally invokes (i. e. not to exploit) would then need to be combined with a malicious repository, which may be tricky. But I don't want to dismiss this vulnerability – it's so easy to fix on Apple's part that they don't have an excuse. There are a few too many neglected corners of their OS where they seriously have to get their act together. But in practical terms, people focus too much on the technologically exciting or Apple/MS/<other divisive entity>-drama provoking vulnerabilities, while there's probably like one or two people working in software who actually verify every hash of every download and audit the source code for every version of every vim plugin they install.
  • vertex-four 10y ago
    > Yeah, but a script that intentionally invokes /usr/bin/git has already achieved the non-privileged access the git vulnerability could provide. Or, in Old New Thing terms, "it rather involved being on the other side of this airtight hatchway". https://blogs.msdn.microsoft.com/oldnewthing/20140529-00/?p=863 https://blogs.msdn.microsoft.com/oldnewthing/20140529-00/?p=...