3 ms·
If I had a local working copy of a git (or any of the dvcs's) repository and a hacker attempted to taint the "master" copy, would that show up as a diff between
by yellowbkpk 17y ago
If I had a local working copy of a git (or any of the dvcs's) repository and a hacker attempted to taint the "master" copy, would that show up as a diff between my copy and the master?
With SVN, a hacker could inject changes into the repo on the server which would show up as a incoming change to my local repository.
In both cases, we could detect an intrusion if someone was vigilant enough to take a look at all incoming/outgoing changes and diffs -- or am I missing something?
- lutorm 17y agoWell, if there are enough people working on a repository, you might be inundated with changes every time you update. You'd never suspect anything unless you knew which files specific users should be editing, and checking that for each patch would probably be prohibitively time consuming. But unless perforce allows you to delete history, it shouldn't be a big deal to fix. The hard part is finding it. I wonder if there are automated systems that can check the patches users commit and look for "outliers" in content or style?
- fierarul 17y agoSo I guess Google's style of code-reviewing every commit should keep them safe from this...
- kvs 17y agoGood point; This is something I wanted to see discussed but the paper didn't touch on it at all. It just focused on tools and vulnerabilities in the tool and didn't dip into the process surrounding the tool.
- joeyh 17y agoWith svn, a clever attacker can make changes to past commits in the repository, so you will not see new commits to review, your own copy of the code will not contain the changes, but when a fresh copy is checked out by eg, a build server for deployment, it will get the modified code. Git mostly prevents that; while sha1 can be attacked, a new, visible commit would have to be made containing the sha1 preimage.