Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Hi!

I can cheerfully confirm that I've absolutely never:

- received a git repo as an archive from someone, and then

- changed to root with "su" before unpacking it somewhere, such that

- the chosen location was above the home directory layer of a multi-user system.

- in such a way that one of the directories of the /path/to/home path has a .git/ subdirectory as a direct child, and not as an unpacked-tarball/.git grandchild which would not be accidentally found by git. I.e. that one of these directories exists, which might be found by someone running "git" in their home:

  /.git
  /path/.git
  /path/to/.git
  /path/to/home/.git
rather than the more likely:

  /foo-project-123/.git
  /path/foo-project-123/.git
  /path/to/foo-project-123/.git
  /path/to/home/foo-project-123/.git
which will not be found by someone running "git" in their home directory.

If I did such a thing, I'd care more about what happens when I happen to step on one of the malicious hooks in that repo as root, and less about what happens if users step on it.



Good for you. You are not everyone.


There are far more likely accidents that the superuser can perpetrate, that we do not compensate for with silly logic in applications.

Superuser could download some malware and put it into the system PATH. OK, so let's not execute anything in the PATH, unless it is owned by us.

/bin/ls? Not owned by me, don't trust it.


Okay.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: