News for hackers. Stuff that matters.

A comment on Git security vulnerability announced. Parent comment

Re:Git security vulnerability announced by hsbauauvhabzb on Wednesday April 13, 2022 @04:11PM (#31019666)
You can download a directory containing a script, cd into that repo and less the file. ‘cd foo’ should never trigger arbitrary command execution. Ever.

Containerisation wouldn’t solve this, bash or similar would almost always be fun with near limitless boundaries.

[ Parent | on HN ]
Re:Git security vulnerability announced by reegnz on Wednesday April 13, 2022 @06:23PM (#31021038)
I beg to disagree. I like my https://direnv.net/

As long as it's strictly opt-in, it's fine. But it needs to be opt-in to be secure.

[ Parent | on HN ]