Hacker News Reader

Comment by necubi | Hacker News Reader

Homebrew just updated (https://github.com/Homebrew/homebrew/pull/35105), so Homebrew users should be covered by

    brew update && brew upgrade git

View on HN

Ironically, Homebrew uses git to update its package metadata, but presumably you already trust Homebrew to not deliver malicious software (I also don't know if "pull" is vulnerable, or just "clone" and "checkout". Also Homebrew is hosted on Github, which now scans/blocks malicious repos)

Further ironically how many people just did a

    brew update && brew upgrade

Without the git part specifically.

> I also don't know if "pull" is vulnerable, or just "clone" and "checkout

Yes it is

Now if you just do fetch and don't merge/rebase you're safe, still, this is a very rare occurence

Make sure you're not using Apple Git (/usr/bin/git); I renamed mine.

Gah. Incidents like this makes me frustrated OS X doesn’t have a solid package manager like APT.

Is package management really at issue here? For Apple supplied software, I think it really boils down to the same thing as other distros/OSes: timeliness of security updates. If Apple isn't able to spin out incremental security updates as quickly as other distributions, I'd say that process issue is the real problem.

Honestly, there's also something to be said for two-tier package management, ala OS X with Homebrew. Self-contained third party apps get a more managable space of base system profiles to target, and the installation UX can be as simple as drag/drop/app works. Us "special needs" users can then layer on and manage more esoteric and/or cutting-edge tools as needed with a full package manager. Heck, I was really glad to see Linuxbrew finally come to fruition for this very same reason. Have your cake and roll a newer-than-distro version of your tools too!

>Honestly, there's also something to be said for two-tier package management, ala OS X with Homebrew

Agreed, I really like the sound of that. Been aching for some time to have a stable base system like deb stable / slackware and then have my development toolchain specifically but other uses might surface / need bleeding edge.

Homebrew (http://brew.sh) is pretty darned solid.

I tend to put /usr/local/bin ahead of /usr/bin on my $PATH, which nicely solves that problem.

It should do, but if an application wants to use /usr/bin/git for some reason they can still just do that!

For those of us using macports, the port file was updated an hour ago: https://trac.macports.org/browser/trunk/dports/devel/git/Por...

    sudo port selfupdate
    sudo port upgrade git

    git --version

And don't copy&paste the above code into the terminal! (Potential vulnerability, though HN is probably safe.)

What is the potential vulnerability?

It's possible to use invisible characters to hide malicious commands during copy-paste[1].

[1]: https://news.ycombinator.com/item?id=5508225

I keep getting

    fatal: unable to access 'https://github.com/Homebrew/homebrew/': The requested URL returned error: 503
    Error: Failure while executing: git pull -q origin refs/heads/master:refs/remotes/origin/master

Weird, it's the first time it's ever happened.

edit: wait, it worked after a couple of tries; maybe it's due to panicked people updating brew\git?

This might be an issue with github due to load or their security fixes or code scans. I've been able to run `brew update && brew upgrade git`.

Bear in mind if you use GitHub for Mac it includes it's own version of Git too. The latest version "Honourary Brit (194)" includes a patch for this fix.

brew update will use `git clone`, so yeah...

Presumably you already trust homebrew to run arbitrary code on your machine.

I'm fairly confident Homebrew isn't exploiting this

If you read the blog post, GitHub has checked all their repos for for this exploit and is blocking it on pushes; cloning from GitHub should be safe.

The blocking pushes is what I was concerned with, along with brew searching pull requests.

You better walk over to the Homebrew office and get the update on a USB stick then, Mr. Safety!

Reply on news.ycombinator.com