4 ms·
Yeah I don't think any of these proposed attacks work without write access to the repo, at which point the game is already pretty much over already.
by lamontcg 5y ago
Yeah I don't think any of these proposed attacks work without write access to the repo, at which point the game is already pretty much over already.
- seoaeu 5y agoThere's plenty of workflows where untrusted people have their proposed changes audited and then written to a git repo
- lamontcg 5y agoHow do they get through the auditing? If I'm looking at a PR which contains a hash collision with code that does a `sudo rm -rf --no-preserve-root /` and I don't accept the malicious code, the hash collision becomes irrelevant.