4 ms·

in other news, access to a users account gives them access to a users account

by calvinmorrison 5y ago

tedunangst 5y ago
In earlier news, it's unexpected that "cd directory" will give the directory owner access to your account.
- dhzhzjsbevs 5y ago
  Tbh I thought this was pretty obvious. Git hooks have always been sketchy as hell. Can't stand the Mac specific shit my co-workers keep dumping in there.
  - hda2 5y ago
    Wait, I thought git hooks aren't pulled from remote. Wouldn't untrusted git hooks mean that git verify-* are useless since you're already running untrusted code?
    - edgyquant 5y ago
      On my current app we use husky which installs hooks when you do a yarn install
      - eru 5y ago
        You are in luck, it seems: https://blog.typicode.com/husky-git-hooks-autoinstall/ https://blog.typicode.com/husky-git-hooks-autoinstall/ (Though not completely sure.)
    - Groxx 5y ago
      Just to react to: >Wait, I thought git hooks aren't pulled from remote. You are correct. They are not. Other tools may auto-install them (I hate it), but git does not ever.
hsbauauvhabzb 5y ago
This is really dismissive. Unexpected execution is not a users fault, and can happen for a variety of reasons (you telling me you’ve never unzipped a full git path someone sent you?)
- seba_dos1 5y ago
  No? Why would someone zip me a git repo? You can clone/push/pull directly between machines.
  - nybble41 5y ago
    The source machine may not be set up as a server, or you may not have an account there. Sending a .zip file could be simpler than pushing the repo to a third system the receiver does have access to.
    - seba_dos1 5y ago
      Sure, mailing binaries can also be the right thing sometimes, but just as with git repos, you definitely shouldn't be taking them from untrusted sources. (and I bet that many people don't even realize how easy using `git push` to mirror a repo actually is, since git is very commonly used in a centralized fashion)
  - hsbauauvhabzb 5y ago
    You’ve never unzipped a repo? That’s something I regularly do - clients can’t get me access to their scm, and it’s not worth the effort.
    - seba_dos1 5y ago
      I don't think I ever did. I usually have an opposite problem and sometimes accidentally zip/tar a repo when it shouldn't be included (at least there's `--exclude-vcs`). In any case, this doesn't sound like a good idea at all, as git hooks exist.

in other news, access to a users account gives them access to a users account

tedunangst 5y ago

In earlier news, it's unexpected that "cd directory" will give the directory owner access to your account.

dhzhzjsbevs 5y ago
Tbh I thought this was pretty obvious. Git hooks have always been sketchy as hell. Can't stand the Mac specific shit my co-workers keep dumping in there.
- hda2 5y ago
  Wait, I thought git hooks aren't pulled from remote. Wouldn't untrusted git hooks mean that git verify-* are useless since you're already running untrusted code?
  - edgyquant 5y ago
    On my current app we use husky which installs hooks when you do a yarn install
    - eru 5y ago
      You are in luck, it seems: https://blog.typicode.com/husky-git-hooks-autoinstall/ https://blog.typicode.com/husky-git-hooks-autoinstall/ (Though not completely sure.)
  - Groxx 5y ago
    Just to react to: >Wait, I thought git hooks aren't pulled from remote. You are correct. They are not. Other tools may auto-install them (I hate it), but git does not ever.

hsbauauvhabzb 5y ago

This is really dismissive. Unexpected execution is not a users fault, and can happen for a variety of reasons (you telling me you’ve never unzipped a full git path someone sent you?)

seba_dos1 5y ago
No? Why would someone zip me a git repo? You can clone/push/pull directly between machines.
- nybble41 5y ago
  The source machine may not be set up as a server, or you may not have an account there. Sending a .zip file could be simpler than pushing the repo to a third system the receiver does have access to.
  - seba_dos1 5y ago
    Sure, mailing binaries can also be the right thing sometimes, but just as with git repos, you definitely shouldn't be taking them from untrusted sources. (and I bet that many people don't even realize how easy using `git push` to mirror a repo actually is, since git is very commonly used in a centralized fashion)
- hsbauauvhabzb 5y ago
  You’ve never unzipped a repo? That’s something I regularly do - clients can’t get me access to their scm, and it’s not worth the effort.
  - seba_dos1 5y ago
    I don't think I ever did. I usually have an opposite problem and sometimes accidentally zip/tar a repo when it shouldn't be included (at least there's `--exclude-vcs`). In any case, this doesn't sound like a good idea at all, as git hooks exist.