3 ms·
It doesn't seem to verify hashes of objects on checkout, but it does when receiving packfiles. So it's difficult to see how this could be an exploit unless the
by simonbyrne 9y ago
It doesn't seem to verify hashes of objects on checkout, but it does when receiving packfiles. So it's difficult to see how this could be an exploit unless the attacker has access to your local .git directory.
- eridius 9y agoIf you're syncing the repository itself (e.g. over Dropbox) instead of using git remotes, then it could be exploited.
- mlindner 9y agoWhy the hell would you do that. That defeats the point of git.
- ianamartin 9y agoBecause anything that can be misused will be. I’m sure there’s a law with someone’s name that states that. But just in case it hasn’t been claimed yet, I’m proposing that we call it the fuck you law. Because the next time someone comes to me to ask me to fix their trello to zappier to email to google sheets setup they use as a project management tool, I want to be able to say, “Fuck you and there’s a law that says so.”
- FullyFunctional 9y agoNo it doesn't. I have many of my git repos in Dropbox but I'm not using Dropbox for sharing. Having those in Dropbox means I get automatic backup and that they are available when I switch to a different computer, which I do, but not frequently. As only I use my Dropbox account, I'm aware of the potential sync problem, but it's never been a problem. I do run fsck & gc more frequently than most, but I probably don't need to. EDIT: I should emphasize that this model is way more convenient than manually having to remember to push and pull all the time. Now push is only for publishing outside as it should be.
- mlindner 9y agoIf you're doing this then there's no reason to use git. Just sync a raw directory.
- FullyFunctional 9y agoNo, I use git to track my development history and I push to github. These are two difference issues.
- deleted 9y ago[deleted]