Re:Git security vulnerability announced
by pvg on Wednesday April 13, 2022 @12:44AM
(#31011275)
The context of one is 'someone committed a thing a few weeks ago and it does a thing, according to someone posting to HN'. The context of the other is 'one of the biggest git users on the planet tells you there's git vuln, fix out right now'.
[ Parent
| on HN ]
Re:Git security vulnerability announced
by Dylan16807 on Wednesday April 13, 2022 @12:48AM
(#31011290)
Git itself removing an ability should tell you that it's a big deal even more than "one of the biggest git users on the planet".
And again, first line says it's a vulnerability. "it does a thing, according to someone posting to HN" is a big fat strawman.
I don't know, it really doesn't sound like a real CVE - maybe add some setting I guess for those worried? Others bring up good points, if your attacker can write to C:\ you probably have other issues.
On top of that, it breaks completely valid functionality - someones 'bug' is someone elses feature.