5 ms·
It moves infrastructure to someone else _whose core job it is to manage this infrastructure_. I definitely trust GH more than myself in managing a git infrastru
by williamdclt 6y ago
It moves infrastructure to someone else _whose core job it is to manage this infrastructure_. I definitely trust GH more than myself in managing a git infrastructure securely
- bogwog 6y agoThat's assuming the self-hosted git server itself was compromised, and it wasn't just a simple matter of the attacker stealing some committer's private keys. If that's what happened, then moving to Github solves nothing. > I definitely trust GH more than myself in managing a git infrastructure securely That's FUD, and appropriate too considering who owns Github now.
- mvolfik 6y agoin comments on the first commit it was said that the access was revoked, but another one appeared, which points at the server
- theamk 6y agoDid you notice that the commit was reverted, but then almost immediately re-applied? This is a strong indication that the server admins did not know the how the server was compromised. With Github, you can: (1) use "events" API to see which account did the push and (2) remove the account's ssh keys and change password from a secure machine to stop compromise right away. This stops the compromise completely. Compared to that, if there was a compromise on our own server, it is quite hard to tell that everything was cleaned. Remember kernel.org compromise in 2011 [0]? They took a few weeks to recover, and this was with some of the best programmers. [0] https://lwn.net/Articles/464233/ https://lwn.net/Articles/464233/
- superkuh 6y agoIt's the style of the times: techno-feudalism. Serve a powerful enough feudal lord by doing your business on their servers and you'll be protected.