4 ms·
Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Li
by jonas21 6y ago
Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.
- SilverRed 6y agoAnd use git LFS and cloned a malicious repo? This bug has probably not affected a single user.
- jonas21 6y agoIsn't the whole point of announcing security patches so that people can update before they're exploited?
- SilverRed 6y agoSure, I'm just saying this isn't a big deal and its likely no one was hit.
- aiisjustanif 6y agoJust because there is not an active threat doesn’t make it any less of a vulnerability to be exploited.
- lucb1e 6y agoIt does if nobody uses it. You can't exploit Apache 2.4.2 proxy bugs if nobody runs Apache 2.4.2 in proxy mode. Of course, you should still update because you're a config change away from being vulnerable, but GP's point of it not being a big deal if (and only if, don't know if that's correct) nobody uses it stands.
- CamJN 6y agoThe GitHub desktop app configures lfs in your gitconfig automatically, so that adds a lot of users to the vulnerable pool.
- anaisbetts 6y agoMany Git distributions come with git-lfs installed by default
- geofft 6y agoI assume the primary user base of git-lfs is folks doing things like video game development (so that they can check in image/audio assets to a repo without massively bloating it), which probably has a much higher fraction of Mac/Windows users than folks writing server-side apps or whatever.
- junon 6y agoThat's not why we do security research.
- trollian 6y agoI would assume that most people developing on macOS have configured case sensitive filesystems. And does Windows do symlinks now? Seems like a weird edge case to me. I guess Apple and Microsoft should push out OS updates to cover it.
- emodendroket 6y agoWindows has done symlinks (known as "junctions") since Windows 2000, so I guess it's a more recent feature you might not have learned about.
- lucb1e 6y agoTo be honest I was a heavy Windows user until Windows 7 yet only recently learned that it has symlink support. It's not something you (used to?) really come across in the ecosystem. That said, I did snicker at the comment :) I had no idea it was that old.
- memorysafety 6y agoThat's a dishonest statement and misrepresents the actual support. The "junctions" are unusable as "windows symlinks". For one, you can't create any as a normal non-admin user without specific authorization by default.
- emodendroket 6y agoOnly the most sadistic company on earth is going to ask you to do development on a Windows machine without admin privileges.
- memorysafety 6y agoI had exactly that done to me. By a huge 200k+ employees corporate monster... You can taste the humiliation of having to justify every sudo through a ticket system. They censored the internet for employees too, in an of course absurdly broken way. Made me learn to read ASN.1 printouts & detect tampering with TLS certs. Add to that an iconic "Office Space"-ey workplace atmosphere, absolutely toxic... made me _request a headset_ from the company (employees are not allowed to bring their own); 2 weeks of ticketing again, and they deliver: an rj45-plug phone headset, with three obscure boxes on the wire (I can only presume, for surveillance). I've been testing my limits for 3 months with them, and left without saying a word. A lesson is a lesson.