5 ms·

`brew upgrade git` No need to wait for Apple.

• pdpi 10y ago
  That still leaves the system git vulnerable, which might be exploitable if you can trick the user into choosing the wrong git binary
  • matt_wulfeck 10y ago
    chmod -x /usr/bin/git
    • orange_county 10y ago
      You can't even remove execute permissions on it. This was stated in the article as well.
    • cuckcuckspruce 10y ago
      That doesn't work for OS 10.11[1]. There's a workaround in that article. [1] http://rachelbythebay.com/w/2016/04/17/unprotected/ http://rachelbythebay.com/w/2016/04/17/unprotected/
    • chris_wot 10y ago
      You can't. That's the point!
      • danieldk 10y ago
        sudo chmod a-x $(xcrun -f git) All problems in computer science can be solved by another level of indirection
        • deleted 10y ago
          [deleted]
        • chris_wot 10y ago
          Er... I gain root access and just do: sudo chmod a+x $(xcrun -f git)
  • Kristine1975 10y ago
    Since the system git redirects to the git in Xcode (or whereever Apple's command line tools are installed), copy homebrew's git there. Updating Xcode itself might be easier, though. Edit: Copy homebrew's git into the directory inside the Xcode application where Xcode's outdated git is.
    • chris_wot 10y ago
      You can't, not even root can. El Capitan is the only Unix in existence that will not allow root to update files in the /usr/bin directory. Edit: turns out that I'm wrong, there are plenty of examples - SELinux, Sun had a version, lots and lots of other examples I just didn't look very hard to find them. Sorry if I misled anyone.
      • cmrx64 10y ago
        Not even close to true... mandatory access control systems are pretty common on widely-used UNIX-like systems. Apple is just the first vendor to ship them enabled by default to end users.
        • chris_wot 10y ago
          Can you give an example?
          • curt15 10y ago
            Apparmor and SeLinux (in Ubuntu and Fedora respectively) can both be configured to restrict the root user (http://unix.stackexchange.com/questions/106595/myth-or-reality-selinux-can-confine-the-root-user http://unix.stackexchange.com/questions/106595/myth-or-reali...).
            • chris_wot 10y ago
              Yeah, I have to agree with cmrx64 - I really was totally wrong. I appreciate the correction, even if I made myself look a bit silly as I learned something valuable! I definitely deserved those downvotes.
  • jdeibele 10y ago
    Right. And because of System Integrity Protection you have to turn SIP off, remove /usr/bin/git and then turn it back on. Had to do that with Java, which was installed on the family Mac just for Minecraft. Minecraft doesn't require it anymore: http://www.howtogeek.com/210907/minecraft-doesnt-need-java-installed-anymore-its-time-to-remove-it/ http://www.howtogeek.com/210907/minecraft-doesnt-need-java-i... Now that Apple is having a (seemingly) permanent beta option for Mac OS it would be nice if they'd have a developer option that would update much more quickly. And would hopefully have better bug reports ... hopefully.
• acdha 10y ago
  As was discussed extensively last time (https://news.ycombinator.com/item?id=11517894 https://news.ycombinator.com/item?id=11517894) that's not a complete fix because it doesn't overwrite /usr/bin/git and so you're hoping that there's no way /usr/bin/git is executed instead of /usr/local/bin/git. It's better than nothing but no substitute for a complete fix — maybe your shell has the right PATH but are you certain there's no way your editor, GUI clients, or third-party utilities like convenience Docker launchers, etc. all use the same search order?
  • deleted 10y ago
    [deleted]