3 ms·

If everyone is concerned about commit identity hijacking, you can configure your repo settings to reject any commits which aren't GPG signed. https://docs.gith

If everyone is concerned about commit identity hijacking, you can configure your repo settings to reject any commits which aren't GPG signed. https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits https://docs.github.com/en/authentication/managing-commit-si... https://www.devopsauthority.tech/2020/07/18/github-getting-started-with-gpg-signed-commits/ https://www.devopsauthority.tech/2020/07/18/github-getting-s...

DyslexicAtheist 5y ago
that's great but it requires an active step on behalf of the user which is violating secure defaults principle. it also violates the principle of good UE
- tremon 5y ago
  Security requirements are often at odds with good UE.
- res0nat0r 5y ago
  There's no way around it, because git commits by default can be forged due to the way it was designed.