Patch applies fake diffs from commit messages

A tiny code change turned into full-on comment section theater after a developer showed that a downloadable GitHub patch can smuggle in a fake extra file if the commit message itself contains text that looks like a patch. In plain English: someone thought they were applying a simple update, but an old-school tool could also read the message text as instructions and create a file that was never actually part of the visible commit. That discovery had readers doing the online equivalent of clutching pearls.

The strongest reactions split into two camps. One side went straight for the "Unix tools are chaos" rant, with one commenter blasting the whole ecosystem for relying on quirky, half-documented text formats and saying this mess wouldn’t happen if everything used a strict, modern structure like JSON or XML. The other side was much less shocked and basically shrugged: if you trust a patch enough to apply it, they argued, why is a sneaky file inside the message any scarier than a sneaky file anywhere else? That take definitely sparked the "is this a real vulnerability or just ugly behavior?" fight.

Then came the practical crowd, dropping fixes and lore like grizzled mechanics under a raised hood. One pointed out that using GitHub’s .diff version avoids the email-style wrapper entirely. Another explained that patch-applying tools already use weird in-band clues like lines starting with diff - to guess where the real changes begin — which, honestly, sounded to readers like the software equivalent of "we made up the rules as we went". The accidental punchline? The whole saga made commit messages look less like innocent notes and more like tiny Trojan horses with very good formatting.