News for hackers. Stuff that matters.

A comment on Git security vulnerability announced. Parent comment

Re:Git security vulnerability announced by tedunangst on Tuesday April 12, 2022 @11:13PM (#31010822)
In earlier news, it's unexpected that "cd directory" will give the directory owner access to your account.
[ Parent | on HN ]
Re:Git security vulnerability announced by dhzhzjsbevs on Tuesday April 12, 2022 @11:19PM (#31010854)
Tbh I thought this was pretty obvious.

Git hooks have always been sketchy as hell.

Can't stand the Mac specific shit my co-workers keep dumping in there.

[ Parent | on HN ]
Re:Git security vulnerability announced by hda2 on Tuesday April 12, 2022 @11:28PM (#31010909)
Wait, I thought git hooks aren't pulled from remote.

Wouldn't untrusted git hooks mean that git verify-* are useless since you're already running untrusted code?

[ Parent | on HN ]
Re:Git security vulnerability announced by Groxx on Wednesday April 13, 2022 @03:02AM (#31011927)
Just to react to:

>Wait, I thought git hooks aren't pulled from remote.

You are correct. They are not. Other tools may auto-install them (I hate it), but git does not ever.

[ Parent | on HN ]
Re:Git security vulnerability announced by edgyquant on Tuesday April 12, 2022 @11:52PM (#31011048)
On my current app we use husky which installs hooks when you do a yarn install
[ Parent | on HN ]
Re:Git security vulnerability announced by eru on Wednesday April 13, 2022 @12:01AM (#31011100)
You are in luck, it seems: https://blog.typicode.com/husky-git-hooks-autoinstall/

(Though not completely sure.)

[ Parent | on HN ]