5 ms·
I have often wondered this myself. Considering if github was ever compromised, could an attacker modify your source code without your knowledge. Seems like a
by onebot 6y ago
I have often wondered this myself. Considering if github was ever compromised, could an attacker modify your source code without your knowledge. Seems like a holy grail of attacks.
What would be interesting if there was some at-rest encryption and maybe some audit functionality.
- Znafon 6y agoYou would notice, the hash of the commit would change and you would get an error message in Git. If this is a vector attack your are worried about, you should sign Git tags with your PGP key and then you would notice any change in the history, each commit depends on its ancestors so signing a tag ensure no older commit can be changed too.
- colejohnson66 6y agoHashes, while sometimes clumsy[0], are an advantage in this instance over, say, SVN or CVS (which use monotonicly increasing commit IDs). [0]: Every time I want to find a commit’s parent(s) in Git, I have to look up the command (I don’t do it often), whereas in SVN I could just subtract one.