Re:Remote code execution in Homebrew by compromising the off...
by rmorey on Saturday April 24, 2021 @11:28AM
(#26925571)
would be interested to see that blog post if you happen to have a link, couldn’t find it googling “github engineering blog homebrew”
[ Parent
| on HN ]
Re:Remote code execution in Homebrew by compromising the off...
by zbentley on Saturday April 24, 2021 @01:54PM
(#26926879)
Not brew, but a very similar set of issues were faced by the GitHub team with the CocoaPods project, which at the time worked similar to Homebrew in that they used github as a CDN/host in a somewhat uncommon way:
https://blog.cocoapods.org/Master-Spec-Repo-Rate-Limiting-Po...
https://github.com/CocoaPods/CocoaPods/issues/4989#issuecomm...
Re:Remote code execution in Homebrew by compromising the off...
by tingletech on Saturday April 24, 2021 @11:50AM
(#26925802)
I can't find it either; but the post I remember was from someone from homebrew. IIRC, homebrew used to do a shallow clone (the first time it ran everyday, or something like that) of the repo with all the taps and casks or whatever is in it. A big old git repo. I think github asked them to change homebrew, and they fixed so that it uses the regular git commands vs trying to get tricky and do a shallow clone.