5 ms·

Homebrew just updated (https://github.com/Homebrew/homebrew/pull/35105 https://github.com/Homebrew/homebrew/pull/35105), so Homebrew users should be covered by

by necubi 12y ago

Homebrew just updated (https://github.com/Homebrew/homebrew/pull/35105 https://github.com/Homebrew/homebrew/pull/35105), so Homebrew users should be covered by brew update && brew upgrade git

tptacek 12y ago
Make sure you're not using Apple Git (/usr/bin/git); I renamed mine.
- cpach 12y ago
  Gah. Incidents like this makes me frustrated OS X doesn’t have a solid package manager like APT.
  - saidajigumi 12y ago
    Is package management really at issue here? For Apple supplied software, I think it really boils down to the same thing as other distros/OSes: timeliness of security updates. If Apple isn't able to spin out incremental security updates as quickly as other distributions, I'd say that process issue is the real problem. Honestly, there's also something to be said for two-tier package management, ala OS X with Homebrew. Self-contained third party apps get a more managable space of base system profiles to target, and the installation UX can be as simple as drag/drop/app works. Us "special needs" users can then layer on and manage more esoteric and/or cutting-edge tools as needed with a full package manager. Heck, I was really glad to see Linuxbrew finally come to fruition for this very same reason. Have your cake and roll a newer-than-distro version of your tools too!
    - lugg 12y ago
      >Honestly, there's also something to be said for two-tier package management, ala OS X with Homebrew Agreed, I really like the sound of that. Been aching for some time to have a stable base system like deb stable / slackware and then have my development toolchain specifically but other uses might surface / need bleeding edge.
  - tillinghast 12y ago
    Homebrew (http://brew.sh http://brew.sh) is pretty darned solid.
- cdjk 12y ago
  I tend to put /usr/local/bin ahead of /usr/bin on my $PATH, which nicely solves that problem.
  - basicallydan 12y ago
    It should do, but if an application wants to use /usr/bin/git for some reason they can still just do that!
tomp 12y ago
And don't copy&paste the above code into the terminal! (Potential vulnerability, though HN is probably safe.)
- sysk 12y ago
  What is the potential vulnerability?
  - jokamoto 12y ago
    It's possible to use invisible characters to hide malicious commands during copy-paste[1]. [1]: https://news.ycombinator.com/item?id=5508225 https://news.ycombinator.com/item?id=5508225
simi_ 12y ago
I keep getting fatal: unable to access 'https://github.com/Homebrew/homebrew/': The requested URL returned error: 503 Error: Failure while executing: git pull -q origin refs/heads/master:refs/remotes/origin/master Weird, it's the first time it's ever happened. edit: wait, it worked after a couple of tries; maybe it's due to panicked people updating brew\git?
- andruby 12y ago
  This might be an issue with github due to load or their security fixes or code scans. I've been able to run `brew update && brew upgrade git`.
IgorPartola 12y ago
brew update will use `git clone`, so yeah...
- brandonbloom 12y ago
  Presumably you already trust homebrew to run arbitrary code on your machine.
- apetresc 12y ago
  I'm fairly confident Homebrew isn't exploiting this
- necubi 12y ago
  If you read the blog post, GitHub has checked all their repos for for this exploit and is blocking it on pushes; cloning from GitHub should be safe.
  - IgorPartola 12y ago
    The blocking pushes is what I was concerned with, along with brew searching pull requests.
- markcerqueira 12y ago
  You better walk over to the Homebrew office and get the update on a USB stick then, Mr. Safety!
tlrobinson 12y ago
Ironically, Homebrew uses git to update its package metadata, but presumably you already trust Homebrew to not deliver malicious software (I also don't know if "pull" is vulnerable, or just "clone" and "checkout". Also Homebrew is hosted on Github, which now scans/blocks malicious repos)
- lugg 12y ago
  Further ironically how many people just did a brew update && brew upgrade Without the git part specifically.
- raverbashing 12y ago
  > I also don't know if "pull" is vulnerable, or just "clone" and "checkout Yes it is Now if you just do fetch and don't merge/rebase you're safe, still, this is a very rare occurence
aleyan 12y ago
For those of us using macports, the port file was updated an hour ago: https://trac.macports.org/browser/trunk/dports/devel/git/Portfile https://trac.macports.org/browser/trunk/dports/devel/git/Por... sudo port selfupdate sudo port upgrade git git --version
lucaspiller 12y ago
Bear in mind if you use GitHub for Mac it includes it's own version of Git too. The latest version "Honourary Brit (194)" includes a patch for this fix.

by necubi 12y ago

Homebrew just updated (https://github.com/Homebrew/homebrew/pull/35105 https://github.com/Homebrew/homebrew/pull/35105), so Homebrew users should be covered by brew update && brew upgrade git

tptacek 12y ago

Make sure you're not using Apple Git (/usr/bin/git); I renamed mine.

cpach 12y ago
Gah. Incidents like this makes me frustrated OS X doesn’t have a solid package manager like APT.
- saidajigumi 12y ago
  Is package management really at issue here? For Apple supplied software, I think it really boils down to the same thing as other distros/OSes: timeliness of security updates. If Apple isn't able to spin out incremental security updates as quickly as other distributions, I'd say that process issue is the real problem. Honestly, there's also something to be said for two-tier package management, ala OS X with Homebrew. Self-contained third party apps get a more managable space of base system profiles to target, and the installation UX can be as simple as drag/drop/app works. Us "special needs" users can then layer on and manage more esoteric and/or cutting-edge tools as needed with a full package manager. Heck, I was really glad to see Linuxbrew finally come to fruition for this very same reason. Have your cake and roll a newer-than-distro version of your tools too!
  - lugg 12y ago
    >Honestly, there's also something to be said for two-tier package management, ala OS X with Homebrew Agreed, I really like the sound of that. Been aching for some time to have a stable base system like deb stable / slackware and then have my development toolchain specifically but other uses might surface / need bleeding edge.
- tillinghast 12y ago
  Homebrew (http://brew.sh http://brew.sh) is pretty darned solid.
cdjk 12y ago
I tend to put /usr/local/bin ahead of /usr/bin on my $PATH, which nicely solves that problem.
- basicallydan 12y ago
  It should do, but if an application wants to use /usr/bin/git for some reason they can still just do that!

tomp 12y ago

And don't copy&paste the above code into the terminal! (Potential vulnerability, though HN is probably safe.)

sysk 12y ago
What is the potential vulnerability?
- jokamoto 12y ago
  It's possible to use invisible characters to hide malicious commands during copy-paste[1]. [1]: https://news.ycombinator.com/item?id=5508225 https://news.ycombinator.com/item?id=5508225

simi_ 12y ago

I keep getting fatal: unable to access 'https://github.com/Homebrew/homebrew/': The requested URL returned error: 503 Error: Failure while executing: git pull -q origin refs/heads/master:refs/remotes/origin/master Weird, it's the first time it's ever happened. edit: wait, it worked after a couple of tries; maybe it's due to panicked people updating brew\git?

andruby 12y ago
This might be an issue with github due to load or their security fixes or code scans. I've been able to run `brew update && brew upgrade git`.

IgorPartola 12y ago

brew update will use `git clone`, so yeah...

brandonbloom 12y ago
Presumably you already trust homebrew to run arbitrary code on your machine.
apetresc 12y ago
I'm fairly confident Homebrew isn't exploiting this
necubi 12y ago
If you read the blog post, GitHub has checked all their repos for for this exploit and is blocking it on pushes; cloning from GitHub should be safe.
- IgorPartola 12y ago
  The blocking pushes is what I was concerned with, along with brew searching pull requests.
markcerqueira 12y ago
You better walk over to the Homebrew office and get the update on a USB stick then, Mr. Safety!

tlrobinson 12y ago

Ironically, Homebrew uses git to update its package metadata, but presumably you already trust Homebrew to not deliver malicious software (I also don't know if "pull" is vulnerable, or just "clone" and "checkout". Also Homebrew is hosted on Github, which now scans/blocks malicious repos)

lugg 12y ago
Further ironically how many people just did a brew update && brew upgrade Without the git part specifically.
raverbashing 12y ago
> I also don't know if "pull" is vulnerable, or just "clone" and "checkout Yes it is Now if you just do fetch and don't merge/rebase you're safe, still, this is a very rare occurence

aleyan 12y ago

For those of us using macports, the port file was updated an hour ago: https://trac.macports.org/browser/trunk/dports/devel/git/Portfile https://trac.macports.org/browser/trunk/dports/devel/git/Por... sudo port selfupdate sudo port upgrade git git --version

lucaspiller 12y ago

Bear in mind if you use GitHub for Mac it includes it's own version of Git too. The latest version "Honourary Brit (194)" includes a patch for this fix.