4 ms·
The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hac
by tlbsofware 6y ago
The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.
- dependenttypes 6y agoHaving openpgp-signed commits would prevent such an issue.
- jlgaddis 6y agoWould it? Couldn't the "hacker" have simply generated a new GPG key and added it to the account he had control of?
- dependenttypes 6y agoThe users would have specific keys trusted.
- as300 6y agoSure, but isn't the point of git to be able to roll back all changes on any branch? And since GitHub is owned by Microsoft, they themselves would surely be able to regain ownership of the account. This seems like a non-story.
- MauranKilom 6y agoHow much code with malicious modifications has been pulled from these repos since then? There's no evidence this happened, but we can't just handwave it away with "we can undo changes".