On: Git client vulnerability announced

[tlrobinson]

Ironically, Homebrew uses git to update its package metadata, but presumably you already trust Homebrew to not deliver malicious software (I also don't know if "pull" is vulnerable, or just "clone" and "checkout". Also Homebrew is hosted on Github, which now scans/blocks malicious repos)

[raverbashing → tlrobinson]

> I also don't know if "pull" is vulnerable, or just "clone" and "checkout

Yes it is

Now if you just do fetch and don't merge/rebase you're safe, still, this is a very rare occurence

[lugg → tlrobinson]

Further ironically how many people just did a

    brew update && brew upgrade

Without the git part specifically.