3 ms·
In most common configurations, authenticated but not logged, and there is no association between the push origin and the contents. If multiple employees have p
by dietrichepp 11y ago
In most common configurations, authenticated but not logged, and there is no association between the push origin and the contents. If multiple employees have push access to a common repo, then Alice can push a commit which claims to be written by Bob, and nobody would probably notice, and there would be very little forensic evidence, if any.
- TheOtherHobbes 11y agoWhich is why commercial crypto and git should never be in the same room together.
- elsjaako 11y agoWhat do you recommend instead?
- jMyles 11y ago> nobody would probably notice Really? Most two-bit cat selfie startups are at least aware enough to notice a phantom commit from Bob, but Juniper isn't?!
- PakG1 11y agoDoesn't it depend on how good their code reviews and release engineers are? You also forget how the negative attributes of big corporations (eg. size, bureaucracy, etc) can make it difficult to notice a phantom commit from Bob, especially if Bob is asleep at the wheel or not motivated.
- Bjartr 11y ago'Minor changes'