Hacker News Reader

Comment by jonas21 | Hacker News Reader

Why is it meaningless? Lots of people use Git on MacOS and Windows. I'd even be willing to bet that there are more people using Git on MacOS and Windows than Linux.

View on HN

And use git LFS and cloned a malicious repo? This bug has probably not affected a single user.

Isn't the whole point of announcing security patches so that people can update before they're exploited?

Sure, I'm just saying this isn't a big deal and its likely no one was hit.

Just because there is not an active threat doesn’t make it any less of a vulnerability to be exploited.

It does if nobody uses it. You can't exploit Apache 2.4.2 proxy bugs if nobody runs Apache 2.4.2 in proxy mode.

Of course, you should still update because you're a config change away from being vulnerable, but GP's point of it not being a big deal if (and only if, don't know if that's correct) nobody uses it stands.

The GitHub desktop app configures lfs in your gitconfig automatically, so that adds a lot of users to the vulnerable pool.

Many Git distributions come with git-lfs installed by default

I assume the primary user base of git-lfs is folks doing things like video game development (so that they can check in image/audio assets to a repo without massively bloating it), which probably has a much higher fraction of Mac/Windows users than folks writing server-side apps or whatever.

That's not why we do security research.

I would assume that most people developing on macOS have configured case sensitive filesystems. And does Windows do symlinks now?

Seems like a weird edge case to me. I guess Apple and Microsoft should push out OS updates to cover it.

Windows has done symlinks (known as "junctions") since Windows 2000, so I guess it's a more recent feature you might not have learned about.

To be honest I was a heavy Windows user until Windows 7 yet only recently learned that it has symlink support. It's not something you (used to?) really come across in the ecosystem.

That said, I did snicker at the comment :) I had no idea it was that old.

That's a dishonest statement and misrepresents the actual support.

The "junctions" are unusable as "windows symlinks".

For one, you can't create any as a normal non-admin user without specific authorization by default.

Only the most sadistic company on earth is going to ask you to do development on a Windows machine without admin privileges.

I had exactly that done to me. By a huge 200k+ employees corporate monster... You can taste the humiliation of having to justify every sudo through a ticket system. They censored the internet for employees too, in an of course absurdly broken way. Made me learn to read ASN.1 printouts & detect tampering with TLS certs. Add to that an iconic "Office Space"-ey workplace atmosphere, absolutely toxic... made me _request a headset_ from the company (employees are not allowed to bring their own); 2 weeks of ticketing again, and they deliver: an rj45-plug phone headset, with three obscure boxes on the wire (I can only presume, for surveillance). I've been testing my limits for 3 months with them, and left without saying a word. A lesson is a lesson.

> most people developing on macOS have configured case sensitive filesystems

I don't think this is true at all. Too many things will break if you turn this on.

Reply on news.ycombinator.com