4 ms·
Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.
by BoberMod 6y ago
Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.
- ocdtrekkie 6y agoIs it the actual source code then? Was it an internal leaker or was GitHub's repo compromised? I have so many questions.
- Karunamon 6y agoIt's the actual source code, but this is the result of two known WONTFIX issues on GitHub: * Any commit can be attributed to any user on the site by way of the author/committer fields in git. No authentication or checking is done. * Any content can be attached to any repository that accepts pull requests, and will be accessible on that repository's url if you have its hash (previous discussion: https://news.ycombinator.com/item?id=24882921 https://news.ycombinator.com/item?id=24882921) More civil disobedience than hack, really.
- jsheard 6y agoGitHub allows enterprise customers to run their own GitHub instance on-premises, so any one of those could have peeked inside the VM and pulled out the source code. https://enterprise.github.com/faq https://enterprise.github.com/faq