{"thread":{"id":"38064","subject":"Where is the best place to report a security vulnerability in git?","startedAt":"2014-11-27T00:49:08Z","lastAt":"2014-11-27T03:32:08Z","messageCount":4,"participants":["Hugh Davenport","Jonathan Nieder","Sitaram Chamarty"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"252624","messageId":"175a570ee03dba2828cb7e129c9445c9@davenport.net.nz","threadId":"38064","inReplyTo":null,"subject":"Where is the best place to report a security vulnerability in git?","fromName":"Hugh Davenport","fromEmail":"hugh@davenport.net.nz","sentAt":"2014-11-27T00:49:08Z","receivedAt":"2014-11-27T00:49:08Z","isPatch":false,"sender":{"key":"hugh@davenport.net.nz","avatar":"https://gravatar.com/avatar/8d2eb4ccc8a7759fd2717289353736bfd9b5d963e629b0e1b231be2c7a090c74?d=mp&s=160"},"body":""},{"id":"252625","messageId":"20141127012053.GU6527@google.com","threadId":"38064","inReplyTo":"175a570ee03dba2828cb7e129c9445c9@davenport.net.nz","subject":"Re: Where is the best place to report a security vulnerability in git?","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2014-11-27T01:20:53Z","receivedAt":"2014-11-27T01:20:53Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Hi Hugh,\n\nHugh Davenport wrote:\n\n> Where is the best place to report a security vulnerability in git?\n\nCurrent practice is to contact Junio C Hamano <gitster@pobox.com>.\nCc-ing Jeff King <peff@peff.net> isn't a bad idea while at it.\n\nWe should probably set up a mailing list to make this more obvious,\nbut that's what we have today.\n\nThanks,\nJonathan\n"},{"id":"252626","messageId":"760122B3-B9D5-4574-9B0D-1EDF95ED53C0@davenport.net.nz","threadId":"38064","inReplyTo":"20141127012053.GU6527@google.com","subject":"Re: Where is the best place to report a security vulnerability in git?","fromName":"Hugh Davenport","fromEmail":"hugh@davenport.net.nz","sentAt":"2014-11-27T02:04:24Z","receivedAt":"2014-11-27T02:04:24Z","isPatch":false,"sender":{"key":"hugh@davenport.net.nz","avatar":"https://gravatar.com/avatar/8d2eb4ccc8a7759fd2717289353736bfd9b5d963e629b0e1b231be2c7a090c74?d=mp&s=160"},"body":"Thanks. Will send a report their way soon\n\nOn 27 November 2014 2:20:53 pm NZDT, Jonathan Nieder <jrnieder@gmail.com> wrote:\n>Hi Hugh,\n>\n>Hugh Davenport wrote:\n>\n>> Where is the best place to report a security vulnerability in git?\n>\n>Current practice is to contact Junio C Hamano <gitster@pobox.com>.\n>Cc-ing Jeff King <peff@peff.net> isn't a bad idea while at it.\n>\n>We should probably set up a mailing list to make this more obvious,\n>but that's what we have today.\n>\n>Thanks,\n>Jonathan\n\n-- \nSent from my Android device with K-9 Mail. Please excuse my brevity.\n"},{"id":"252627","messageId":"54769B38.30708@gmail.com","threadId":"38064","inReplyTo":"20141127012053.GU6527@google.com","subject":"Re: Where is the best place to report a security vulnerability in git?","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2014-11-27T03:32:08Z","receivedAt":"2014-11-27T03:32:08Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On 11/27/2014 06:50 AM, Jonathan Nieder wrote:\n> Hi Hugh,\n> \n> Hugh Davenport wrote:\n> \n>> Where is the best place to report a security vulnerability in git?\n> \n> Current practice is to contact Junio C Hamano <gitster@pobox.com>.\n> Cc-ing Jeff King <peff@peff.net> isn't a bad idea while at it.\n> \n> We should probably set up a mailing list to make this more obvious,\n> but that's what we have today.\n\nHi Hugh,\n\nI maintain a somewhat widely used access control program for remote\naccess to git, so I'm interested also.\n\nGitolite [1] and similar systems provide access control for git repos.\nThere's a very good chance that something which is not a concern for\n\"local\" use, could become an attack vector if enabled through gitolite.\n\nHence my interest, and my request that I be copied.\n\nJonathan/Junio/Jeff: if such a mailing list does happen please consider\nadding me into it.\n\nregards\nsitaram\n\n[1]: https://gitolite.com\n"}]}