3 ms·
Ironically, Homebrew uses git to update its package metadata, but presumably you already trust Homebrew to not deliver malicious software (I also don't know if
by tlrobinson 12y ago
Ironically, Homebrew uses git to update its package metadata, but presumably you already trust Homebrew to not deliver malicious software (I also don't know if "pull" is vulnerable, or just "clone" and "checkout". Also Homebrew is hosted on Github, which now scans/blocks malicious repos)
- lugg 12y agoFurther ironically how many people just did a brew update && brew upgrade Without the git part specifically.
- raverbashing 12y ago> I also don't know if "pull" is vulnerable, or just "clone" and "checkout Yes it is Now if you just do fetch and don't merge/rebase you're safe, still, this is a very rare occurence