git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH v1] read_index_from(): Skip verification of the cache entry order to speed index loading

From
Stefan Beller <sbeller@google.com>
Date
Oct 20, 2017, 18:53 UTC
Message-ID
<CAGZ79kZ_WjnH-vM84C8cE-jS=V=p4tGSiwXX3cKwbDOUvUs_dA@mail.gmail.com>
In-Reply-To
<alpine.DEB.2.21.1.1710201444590.40514@virtualbox>
> Ben's original mail talks about integrity checks of the index file, and
> how expensive they get when you talk about any decent-sized index (read:
> *a lot* larger than Git or even Linux developers will see regularly).
I am quite aware of your situation.
Show 8 quoted lines
> The text you quoted talks about our talking out of our rear ends when we
> talk about typical user schenarios because we simply have no telemetry or
> otherwise reliable statistics.
>
> Now, I fail to see any relationship between Jonathan's mail and either of
> Ben's statements.
>
> Care to enlighten me?

There was a recent thread (which I assumed was the one I linked), that talked about security implications as soon as we loose the rather strict "git is to be used in a posix world", e.g. sharing your repo over NFS/Dropbox. The specific question that Peff asked was how the internal formats can be exploited. (Can a malicious index file be crafted such that it is not just a segfault, but a 'remote' code execution, given that you deploy the maliciously crafted file via NFS. Removing checks that we already have made me a bit suspicious that it *may* be helping an attacker here, though I have no hard data to show)

Sorry for the confusion,

Thanks, Stefan

Previous: Johannes SchindelinNext: Junio C Hamano
Message 8 of 18 in “read_index_from(): Skip verification of the cache entry order to speed index loading”
  1. read_index_from(): Skip verification of the cache entry order to speed index loadingBen Peart, Oct 18, 2017
  2. Junio C HamanoOct 19, 2017
  3. Ben PeartOct 19, 2017
  4. Jeff KingOct 19, 2017
  5. Junio C HamanoOct 20, 2017
  6. Stefan BellerOct 19, 2017
  7. Johannes SchindelinOct 20, 2017
  8. Stefan BellerOct 20, 2017
  9. Junio C HamanoOct 21, 2017
  10. read_index_from(): Skip verification of the cache entry order to speed index loadingBen Peart, Oct 24, 2017
  11. Ben PeartOct 30, 2017
  12. Jeff KingOct 30, 2017
  13. Alex VandiverOct 31, 2017
  14. Ben PeartOct 31, 2017
  15. Jeff KingOct 31, 2017
  16. Junio C HamanoNov 1, 2017
  17. Junio C HamanoOct 31, 2017
  18. Ben PeartOct 31, 2017

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.