4 ms·

This article on a CVE for git published today has details on the vulnerability: https://github.blog/2022-04-12-git-security-vulnerability-announced/ https://git

This article on a CVE for git published today has details on the vulnerability: https://github.blog/2022-04-12-git-security-vulnerability-announced/ https://github.blog/2022-04-12-git-security-vulnerability-an...

dang 5y ago
Ok, we've changed to that from https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9 https://github.com/git/git/commit/8959555cee7ec045958f9b6dd6.... Thanks!
- delsarto 5y ago
  I feel like title doesn't really focus on the specific behaviour change (not operating in a non-owned directories) that will be affecting a lot of CI/CD, which is what I was interesting in seeing discussion on.
- krick 5y ago
  You basically substituted both the link and the title to a completely different one after long time people discussing that specific link and title. Now half of the comments don't really make sense at the first glance.
  - pvg 5y ago
    The original link barely made any sense and many of those comments were comments without the useful context. The root cause here is the iffy submission, not the outdated comments or the change to a more meaningful link.
    - Dylan16807 5y ago
      The original title was "Git 2.30.3 will not operate in non-owned directories" which makes perfect sense to me, and the link provides a good explanation of the security problem. What barely makes any sense about it?
      - pvg 5y ago
        It's a made-up title linking to some random commit. The new link tells you it's a fix for a vulnerability, the details, its CVE, affected platforms and use cases, etc, etc. The other thing doesn't.
        Dylan16807 5y ago
        The title was "made up", I'll give you that, but it's a pretty good paraphrase of the commit title to add context. The old link also tells you it's a fix for a vulnerability, and also explains how it affects all platforms, and also talks about the use cases etc etc. The only thing it doesn't have is a CVE number, which I don't think is all that important.
        pvg 5y ago
        The official announcement tells your that there's a vuln, it's considered important enough to break things and that it's out right now. The other thing tells you someone committed something a few weeks ago. The missing context also helps drive a lot of under-informed grumpy threads, rather than bettter-informed grumpy comments/threads. There'd have probably been fewer grumpy threads with the better link.
        Dylan16807 5y ago
        They both say right at the top that it's a vulnerability, and the old title put the breakage front and center. So I don't know what you mean by missing context.
        pvg 5y ago
        The context of one is 'someone committed a thing a few weeks ago and it does a thing, according to someone posting to HN'. The context of the other is 'one of the biggest git users on the planet tells you there's git vuln, fix out right now'.
  - dang 5y ago
    Yeah, that happens sometimes, but if the second link is more suitable then the discussion eventually adapts for the better. So the only real question is which link is more suitable. One principle I like to use is to assume readers are smart—e.g. in this case, that readers are smart enough to figure out that there are two relevant links to the comments. Of course randomness is also a factor, but it mostly all works out.
- mlindner 5y ago
  Ah ok this was the real link. The top level link to github.blog doesn't seem to have anything that this link here has. Please change it back.
  - dang 5y ago
    Sorry for the confusion! I've added https://news.ycombinator.com/item?id=31016938 https://news.ycombinator.com/item?id=31016938 at the top of the thread so people will see both links.

dang 5y ago

Ok, we've changed to that from https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9 https://github.com/git/git/commit/8959555cee7ec045958f9b6dd6.... Thanks!

delsarto 5y ago
I feel like title doesn't really focus on the specific behaviour change (not operating in a non-owned directories) that will be affecting a lot of CI/CD, which is what I was interesting in seeing discussion on.
krick 5y ago
You basically substituted both the link and the title to a completely different one after long time people discussing that specific link and title. Now half of the comments don't really make sense at the first glance.
- pvg 5y ago
  The original link barely made any sense and many of those comments were comments without the useful context. The root cause here is the iffy submission, not the outdated comments or the change to a more meaningful link.
  - Dylan16807 5y ago
    The original title was "Git 2.30.3 will not operate in non-owned directories" which makes perfect sense to me, and the link provides a good explanation of the security problem. What barely makes any sense about it?
    - pvg 5y ago
      It's a made-up title linking to some random commit. The new link tells you it's a fix for a vulnerability, the details, its CVE, affected platforms and use cases, etc, etc. The other thing doesn't.
      - Dylan16807 5y ago
        The title was "made up", I'll give you that, but it's a pretty good paraphrase of the commit title to add context. The old link also tells you it's a fix for a vulnerability, and also explains how it affects all platforms, and also talks about the use cases etc etc. The only thing it doesn't have is a CVE number, which I don't think is all that important.
        pvg 5y ago
        The official announcement tells your that there's a vuln, it's considered important enough to break things and that it's out right now. The other thing tells you someone committed something a few weeks ago. The missing context also helps drive a lot of under-informed grumpy threads, rather than bettter-informed grumpy comments/threads. There'd have probably been fewer grumpy threads with the better link.
        Dylan16807 5y ago
        They both say right at the top that it's a vulnerability, and the old title put the breakage front and center. So I don't know what you mean by missing context.
        pvg 5y ago
        The context of one is 'someone committed a thing a few weeks ago and it does a thing, according to someone posting to HN'. The context of the other is 'one of the biggest git users on the planet tells you there's git vuln, fix out right now'.
- dang 5y ago
  Yeah, that happens sometimes, but if the second link is more suitable then the discussion eventually adapts for the better. So the only real question is which link is more suitable. One principle I like to use is to assume readers are smart—e.g. in this case, that readers are smart enough to figure out that there are two relevant links to the comments. Of course randomness is also a factor, but it mostly all works out.
mlindner 5y ago
Ah ok this was the real link. The top level link to github.blog doesn't seem to have anything that this link here has. Please change it back.
- dang 5y ago
  Sorry for the confusion! I've added https://news.ycombinator.com/item?id=31016938 https://news.ycombinator.com/item?id=31016938 at the top of the thread so people will see both links.