News for hackers. Stuff that matters.
Re:git-landmine – create local malicious Git repo by meatmanek on Saturday July 01, 2023 @09:13PM (#36557177)
I think the reason this is a script (`git-landmine`) and not just a repo is that git repos don't include this sort of configuration when you clone them, for exactly this reason.

It's inconvenient that you don't get e.g. pre-commit hooks installed when you clone a repo, but it also makes total sense from a security perspective.

Re:git-landmine – create local malicious Git repo by xyzzy_plugh on Saturday July 01, 2023 @09:44PM (#36557343)
It's not inconvenient -- it's great. I would never run a pre-commit hook someone else wrote. I'm not a child, I don't need my hand held. If I want to create a commit object, create one.

I don't understand folks who want their tools to fight them.

Re:git-landmine – create local malicious Git repo by thfuran on Saturday July 01, 2023 @10:43PM (#36557674)
Would you ever run a kernel written by someone else?
Re:git-landmine – create local malicious Git repo by shortcake27 on Saturday July 01, 2023 @10:57PM (#36557763)
> I'm not a child, I don't need my hand held … I don't understand folks who want their tools to fight them.

The thing about teams is that they’re made up of people with different needs, and the tooling works to benefit the entire team not just one specific opinionated individual.

Formatting and linting is frequently done in precommit hooks. This avoids a much longer feedback loop of CI failures for trivial tasks that add at most a couple of seconds to a commit (usually less).

If you don’t like it, you can simply eject out of it using the no-verify flag instead of complaining about having to fight tooling that benefits everyone else.

Re:git-landmine – create local malicious Git repo by xyzzy_plugh on Wednesday July 05, 2023 @11:00PM (#36610528)
I already ejected out by not setting up the hooks to begin with. No problem!

The problem with hooks is that inevitably the smartass who sets them up thinks they're clever and makes the hooks so elaborate that they are borderline inaccessible outside of the hook themselves. Just put the linter in the lint build rule. I'm an adult, I can run builds and tests and lints myself. I'm fully capable of ensuring my code is of sufficient quality prior to CI.

If you're not capable of that, then certainly do what you need to. Having others help you is great as well. It's always a good to make things easy to get right out of the box.

But don't make your problem my problem.

Re:git-landmine – create local malicious Git repo by sirsuki on Sunday July 02, 2023 @09:09AM (#36561149)
> I don't understand folks who want their tools to fight them.

Been coding professionally for a few decades now and I completely understand and validate this. I also do not understand the drive to want tools that fight them. Our CI is so slow doing IMO unnecessary checks. Code is prettified to look ugly and hard to read because others were too lazy to align text manually and just gave up on nice looking code.

All in the name of “making it easier for the less experienced.” To which I cringe because instead of investing in education and team quality standards we invest in tools to enforce a lowest common denominator in a failed attempt to pretend it increases quality when it just gets in everyones’ way.

I’d rather educate and engender personal quality, aesthetics, and pride in their own work. And if others don’t feel that quality matters then they are not a good fit for my team.

Re:git-landmine – create local malicious Git repo by armada651 on Sunday July 02, 2023 @02:13AM (#36558747)
Indeed you're correct the risk is not when cloning a repo but when copying an existing one.