3 ms·
> When auditing a source repository you want to see how commits are signed over time. I understand your reasoning and the idea behind GPG and everything, but h
by hannob 5y ago
> When auditing a source repository you want to see how commits are signed over time.
I understand your reasoning and the idea behind GPG and everything, but here's my challenge to all of this: Has this ever happened?
Like, the scenario we're talking about is that at some point some bad code, maybe a backdoor, got introduced into a code repo, and it later is discovered and someone launches an investigation. And they find out "this was committed by XYZ but XYZ claims he didn't do it".
I don't remember any such incident ever. Given that I feel a slightly weaker form with SSH keys may still be justified. (And it is still easily conceivable to have some out-of-band-metadata, e.g. a project that feels this is important could just have a list of developer SSH key fingerprints within the repo and thus have the backlog of who's keys were relevant at what point in time.)
- er4hn 5y ago> Has this ever happened? Unfortunately this has: https://www.wired.com/2015/12/researchers-solve-the-juniper-mystery-and-they-say-its-partially-the-nsas-fault/ https://www.wired.com/2015/12/researchers-solve-the-juniper-... While the full results were not released, it was pretty clear that a rogue commit happened to the VCS. This is the highest profile example that has occurred in my corner of the tech world. The broader category of this attack is "insider threat" and it is a real thing. Even googling for "malicious code commit" turns up this other example for me as one of the first results: https://www.theregister.com/2021/03/29/php_repository_infected/ https://www.theregister.com/2021/03/29/php_repository_infect...
- deleted 5y ago[deleted]
- hannob 5y agoGiven Juniper released basically nothing about their investigation, I'm not convinced this is a valid example. Notably, I'm not just asking if there ever was a bad commit that was investigated - but that the commit came from someone who later claimed she/he didn't do it.