News for hackers. Stuff that matters.
Re:Remote code execution in Homebrew by compromising the off... by rmorey on Saturday April 24, 2021 @11:28AM (#26925571)
would be interested to see that blog post if you happen to have a link, couldn’t find it googling “github engineering blog homebrew”
Re:Remote code execution in Homebrew by compromising the off... by zbentley on Saturday April 24, 2021 @01:54PM (#26926879)
Not brew, but a very similar set of issues were faced by the GitHub team with the CocoaPods project, which at the time worked similar to Homebrew in that they used github as a CDN/host in a somewhat uncommon way:

https://blog.cocoapods.org/Master-Spec-Repo-Rate-Limiting-Po...

https://github.com/CocoaPods/CocoaPods/issues/4989#issuecomm...

Re:Remote code execution in Homebrew by compromising the off... by tingletech on Saturday April 24, 2021 @11:50AM (#26925802)
I can't find it either; but the post I remember was from someone from homebrew. IIRC, homebrew used to do a shallow clone (the first time it ran everyday, or something like that) of the repo with all the taps and casks or whatever is in it. A big old git repo. I think github asked them to change homebrew, and they fixed so that it uses the regular git commands vs trying to get tricky and do a shallow clone.