8 ms·
Lots of source control systems don't offer that level of verification. Even Git, with SHA-1 hashes everywhere, lets you claim to be anybody when you write a co
by dietrichepp 11y ago
Lots of source control systems don't offer that level of verification. Even Git, with SHA-1 hashes everywhere, lets you claim to be anybody when you write a commit. The only thing you can verify the origin of in Git is the author of a tag signature, for tags that are signed with a PGP key.
- Pxtl 11y agoWell, that's the commit. Usually the "push" operation to the origin is auth'd, isn't it?
- dietrichepp 11y agoIn most common configurations, authenticated but not logged, and there is no association between the push origin and the contents. If multiple employees have push access to a common repo, then Alice can push a commit which claims to be written by Bob, and nobody would probably notice, and there would be very little forensic evidence, if any.
- TheOtherHobbes 11y agoWhich is why commercial crypto and git should never be in the same room together.
- elsjaako 11y agoWhat do you recommend instead?
- jMyles 11y ago> nobody would probably notice Really? Most two-bit cat selfie startups are at least aware enough to notice a phantom commit from Bob, but Juniper isn't?!
- PakG1 11y agoDoesn't it depend on how good their code reviews and release engineers are? You also forget how the negative attributes of big corporations (eg. size, bureaucracy, etc) can make it difficult to notice a phantom commit from Bob, especially if Bob is asleep at the wheel or not motivated.
- Bjartr 11y ago'Minor changes'
- meesterdude 11y ago> In more recent versions of Git (v1.7.9 and above), you can now also sign individual commits. https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work does this resolve the issue for git? or is it still possible to subvert?
- dietrichepp 11y agoThat only solves authentication, not authorization.
- tajen 11y agoSo you can trace for sure who made every commit, but you're saying an unauthorized actor can add a commit? Well you would detect that in the code review before the release.
- chei0aiV 11y agogit supports signed pushes as well as signed commits and tags. The signed pushes thing had a vulnerability though: http://mikegerwitz.com/papers/git-horror-story http://mikegerwitz.com/papers/git-horror-story https://developer.atlassian.com/blog/2015/05/git-horror-story-loose-nonces/ https://developer.atlassian.com/blog/2015/05/git-horror-stor...
- TwoBit 11y ago"even git"? I'm not sure git is the best example of a secure system. Commercial source control systems have more serious authentication.
- dietrichepp 11y ago"Even git" because Git is known to use cryptographic hashes and cryptographically signed tags to verify contents, whereas older systems like SVN and CVS had no such structure.
- nolok 11y agoYeah but what I think he means is that in any field were security is important svn and cvs aren't relevant in anyway. Compared to other in that area, git is not the best.
- jlgaddis 11y agoOf course, OpenBSD uses CVS exclusively.
- frankzinger 11y agoSo another poster mentioned Perforce. Which "others" are you referring to?
- kingosticks 11y agoWhat do they use?
- pfortuny 11y agoProbably something with Dual_EC in it...
- raverbashing 11y ago"Commercial source control systems" are usually a steaming piece of crap and I take git over anything that was bought by the higher-ups in ties