News for hackers. Stuff that matters.

A comment on Remote code execution in Homebrew by compromising the official Cask repository. Parent comment

Re:Remote code execution in Homebrew by compromising the off... by nhoughto on Saturday April 24, 2021 @06:38AM (#26923855)
yep is a founding decision, so they can use free git/github infrastructure to run their entire backend, and someone else pays for it. To do what you describe would require hosting something outside of that, which would cost $.

Reminds me of at least 1 github engineering blogpost where they reference Homebrew repo(s) as pathological examples, repos that cause them pain to operate effectively because they just don't 'look' like almost anything else.

Is what happens when you build your entire architecture around using someone elses free-tier / public service.

[ Parent | on HN ]
Re:Remote code execution in Homebrew by compromising the off... by rmorey on Saturday April 24, 2021 @11:28AM (#26925571)
would be interested to see that blog post if you happen to have a link, couldn’t find it googling “github engineering blog homebrew”
[ Parent | on HN ]
Re:Remote code execution in Homebrew by compromising the off... by zbentley on Saturday April 24, 2021 @01:54PM (#26926879)
Not brew, but a very similar set of issues were faced by the GitHub team with the CocoaPods project, which at the time worked similar to Homebrew in that they used github as a CDN/host in a somewhat uncommon way:

https://blog.cocoapods.org/Master-Spec-Repo-Rate-Limiting-Po...

https://github.com/CocoaPods/CocoaPods/issues/4989#issuecomm...

[ Parent | on HN ]
Re:Remote code execution in Homebrew by compromising the off... by tingletech on Saturday April 24, 2021 @11:50AM (#26925802)
I can't find it either; but the post I remember was from someone from homebrew. IIRC, homebrew used to do a shallow clone (the first time it ran everyday, or something like that) of the repo with all the taps and casks or whatever is in it. A big old git repo. I think github asked them to change homebrew, and they fixed so that it uses the regular git commands vs trying to get tricky and do a shallow clone.
[ Parent | on HN ]