July 22, 2026
Double dash, double drama
git's –end-of-options Flag
Git’s weird hidden safety switch has commenters screaming, joking, and facepalming
TLDR: Git has a little-known safety flag that helps stop dangerous mix-ups when a user-supplied name looks like a command option, and it exists because Git already used the usual symbol for something else. Commenters were split between mocking the mess, joking about naming branches `--`, and arguing Git has become far too complicated for normal humans.
A tiny command-line flag turned into a full-blown community therapy session this week after readers discovered Git, the massively popular code tool, has a little-known safety feature called --end-of-options. In plain English: it helps stop Git from mistaking a user-provided name for a dangerous command setting. That matters because attackers can sometimes sneak in values starting with a dash and make a program do something wildly different than intended. Yes, even when no shell is involved. Very comforting!
But the real fireworks were in the comments, where the reaction was basically: why is Git like this? One exasperated reader called Git’s old decision to use -- in a special way a “nightmare for humans,” kicking off the classic tech argument between “tools should be flexible” and “tools should not require a PhD in punctuation.” Another went straight for chaos, joking that the obvious next move is naming a branch --, which is exactly the kind of goblin energy the internet rewards.
There was also elite nitpicking, because of course there was: one commenter spotted that the article title used an en dash instead of a proper double hyphen and dropped an xkcd like a mic. Meanwhile, the hottest serious take was that Git has become ridiculously complex, with one reader practically asking whether maybe—just maybe—people should stop creating weird filenames and edge-case disasters in the first place. In other words, the flag is real, the security issue is real, and the comment section turned it into a glorious mix of panic, memes, and “this is why normal people fear terminals.”
Key Points
- •Git added `--end-of-options` in version 2.24.0 because Git’s existing `--` marker was already used to separate revisions from pathspecs rather than to end option parsing.
- •In Git, `--` and `--end-of-options` have different roles, and safely handling untrusted revisions may require both markers in the same command.
- •Support for `--end-of-options` was added incrementally across Git subcommands, with `git rev-parse` gaining it in 2.30.0 and `git checkout` and `git reset` not accepting it until 2.43.1.
- •The article describes argument injection as CWE-88, distinct from command injection because it can occur even when a program uses an argv array and does not invoke a shell.
- •Examples in the article show similar argument-injection patterns affecting Git, Mercurial, Subversion, CVS, SSH, and `docker build`, including coordinated CVE disclosures in 2017 and CVE-2019-13139.