News for hackers. Stuff that matters.
Re:Git security vulnerability announced by asvitkine on Wednesday April 13, 2022 @12:32AM (#31011212)
Can you explain? A shell isn't supposed to be installing things on it's own... (Assuming you're talking about zsh or bash when you say shell.)
Re:Git security vulnerability announced by ratcline on Wednesday April 13, 2022 @04:04AM (#31012227)
It's not doing it on it's own, I believe what they're referring to is a a pre-configured distribution of a shell packaged with some distributions of Git, for some OSes.
Re:Git security vulnerability announced by jyrkesh on Wednesday April 13, 2022 @03:44AM (#31012129)
There's a lot of different ways to install Git on a lot of different OSes, and some of them put helper shell scripts down by default.
Re:Git security vulnerability announced by Sharparam on Wednesday April 13, 2022 @05:02AM (#31012524)
That isn't Git installing things though, that is third-party Git distributions bundling things along with Git.
Re:Git security vulnerability announced by jyrkesh on Wednesday April 13, 2022 @08:31PM (#31022034)
I'm aware, which is why I phrased it like I did. A lot of folks don't know or understand the distinction when they're installing Git (or installing something else that happens to bring Git with it).

The overarching point is that the shell itself is not installing anything at shell runtime. E.g. it's the Git Bash installer, not opening `bash`.

Re:Git security vulnerability announced by loa_in_ on Wednesday April 13, 2022 @12:35AM (#31011223)
Yeah, even zsh doesn't do this by default