4 ms·

Why is it committed by nat himself? I assume it's a tease of github source code being open sourced similar to GitLab?

by nikivi 6y ago

speedgoose 6y ago
I bet on a hack.
- f311a 6y ago
  It's definitely a hack. Look at the commit message.
BoberMod 6y ago
Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.
- ocdtrekkie 6y ago
  Is it the actual source code then? Was it an internal leaker or was GitHub's repo compromised? I have so many questions.
  - Karunamon 6y ago
    It's the actual source code, but this is the result of two known WONTFIX issues on GitHub: * Any commit can be attributed to any user on the site by way of the author/committer fields in git. No authentication or checking is done. * Any content can be attached to any repository that accepts pull requests, and will be accessible on that repository's url if you have its hash (previous discussion: https://news.ycombinator.com/item?id=24882921 https://news.ycombinator.com/item?id=24882921) More civil disobedience than hack, really.
  - jsheard 6y ago
    GitHub allows enterprise customers to run their own GitHub instance on-premises, so any one of those could have peeked inside the VM and pulled out the source code. https://enterprise.github.com/faq https://enterprise.github.com/faq
jeroenhd 6y ago
No. Commits are trivial to fake because there's not authentication on the commits themselves. How to commit as nat: ``` git config --global user.name "Nat Friedman" git config --global user.email "nat@nat.org" git add . git commit -m "felt cute, might put gh source code on dmca repo now idk" ``` You can pretty much add any email address to commits. This is why you cannot trust any commit unless they've been signed with a public key assigned to an account or email address (aka "Verified" on Github/Gitlab, or verified with a trusted GPG key, or some other method you consider reliable enough for code signatures). The git book has an explanation on how to set up code signing if you're curious: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

Why is it committed by nat himself? I assume it's a tease of github source code being open sourced similar to GitLab?

by nikivi 6y ago

Why is it committed by nat himself? I assume it's a tease of github source code being open sourced similar to GitLab?

speedgoose 6y ago

I bet on a hack.

f311a 6y ago
It's definitely a hack. Look at the commit message.

BoberMod 6y ago

Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.

ocdtrekkie 6y ago
Is it the actual source code then? Was it an internal leaker or was GitHub's repo compromised? I have so many questions.
- Karunamon 6y ago
  It's the actual source code, but this is the result of two known WONTFIX issues on GitHub: * Any commit can be attributed to any user on the site by way of the author/committer fields in git. No authentication or checking is done. * Any content can be attached to any repository that accepts pull requests, and will be accessible on that repository's url if you have its hash (previous discussion: https://news.ycombinator.com/item?id=24882921 https://news.ycombinator.com/item?id=24882921) More civil disobedience than hack, really.
- jsheard 6y ago
  GitHub allows enterprise customers to run their own GitHub instance on-premises, so any one of those could have peeked inside the VM and pulled out the source code. https://enterprise.github.com/faq https://enterprise.github.com/faq

jeroenhd 6y ago

No. Commits are trivial to fake because there's not authentication on the commits themselves. How to commit as nat: ``` git config --global user.name "Nat Friedman" git config --global user.email "nat@nat.org" git add . git commit -m "felt cute, might put gh source code on dmca repo now idk" ``` You can pretty much add any email address to commits. This is why you cannot trust any commit unless they've been signed with a public key assigned to an account or email address (aka "Verified" on Github/Gitlab, or verified with a trusted GPG key, or some other method you consider reliable enough for code signatures). The git book has an explanation on how to set up code signing if you're curious: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work