Show HN: "Git who" – A new CLI tool for industrial-scale Git blaming

Re:Show HN: "Git who" – A new CLI tool for industrial-scale ... by mdaniel on Tuesday March 18, 2025 @09:14PM (#43407303)

I am guessing it only resorts to that expansion if it dosesn't _already_ know about the command, because $(printf '#!/bin/sh\necho pwned\n' > /bin/git-status; chmod 755 /bin/git-status; git status) results in the thing happening that you'd expect, not a mysterious message

FWIW, both brew and kubectl also have adopted this behavior (of $(basename)-plugin style verb extensions) so I find it unlikely they'd all do it if it was a straight-up facepalm

[ Parent | on HN ]

Re:Show HN: "Git who" – A new CLI tool for industrial-scale ... by igorbark on Tuesday March 18, 2025 @09:30PM (#43407413)

probably adding a confirmation message the first time the alias is used for each command would be good, it would be nice to know when i'm invoking git and when i'm invoking a third party binary regardless of any exploit attempts!

[ Parent | on HN ]

Re:Show HN: "Git who" – A new CLI tool for industrial-scale ... by account42 on Wednesday March 19, 2025 @05:53AM (#43409960)

If malicious code ends up in your $PATH you have much bigger problems than git having a seamless plugin architecture.

[ Parent | on HN ]