4 ms·

I wonder if the signed features of GitHub would have helped here. Probably can't ask all the 3rd party contributors to setup signing commits, but it would help

I wonder if the signed features of GitHub would have helped here. Probably can't ask all the 3rd party contributors to setup signing commits, but it would help to spot commits not signed.

trulyrandom 6y ago
If the attackers would have used their own name/email linked to a GitHub account and signed the backdoor commits, GitHub would display a green "Signed" label, and everything would look OK to an outsider.
- megous 6y ago
  That's why it's just a gimmick. Signing only works as protection against hosting compromise if the signing/verification is separate from the hosting itself. Someone responsible for release would have to manually keep a list of keys of authorized comiters and check the repository against this list at the very least prior to a release.
  - kenmacd 6y ago
    The number of people with direct commit access is almost certainly less than the number of commits in a release though. Without signatures you have to verify every commit.
    - megous 6y ago
      I'm not against signatures. I just think relying on third party system to verify them is a gimmick.
- kenmacd 6y ago
  It's not about the green label. A set if commits signed by some unknown person is a lot easier to spot and clean up. Looking at these commits they say mid-2017. Without signatures any previous commit could be by the same author.
taspeotis 6y ago
> I wonder if the signed features of GitHub Uh, you mean the features of ... Git?