3 ms·
I'm guessing the goal is to lock down git's security for any potential future vulnerability. If some security issue was discovered with git that could be exploi
by geoffeg 5y ago
I'm guessing the goal is to lock down git's security for any potential future vulnerability. If some security issue was discovered with git that could be exploited with a malicious .git directory structure, requiring git directories to be owned by the logged-in user will reduce the impact.
- hadlock 5y agoOr, an exploit was discovered, and quietly patched out recently
- hadlock 5y agoOh, there it is: https://github.blog/2022-04-12-git-security-vulnerability-announced/ https://github.blog/2022-04-12-git-security-vulnerability-an...
- hadlock 5y agoReplying to myself again, apparently the thread title changed from "hey git won't let you do this thing anymore" to "here's the CVE", and changed the link too. sorry for the confusion