· updated · Permalink
in reply to
Filippo Valsorda (@filippo.abyssdomain.expert)
What's the point if GitHub has unsandboxed RCEs, Hugging Face has unsandboxed RCEs, Forgejo has unsandboxed RCEs... Anyway, we gotta stop shelling out to git in security contexts.
Did you know that GitHub has to pin an ancient version of git-archive and gzip because people pinned sha-256 hashes?
Comments