6 ms·
I don’t know for certain but I feel like this could allow something like 1. Takeover/inherit public repo with lots of stars 2. Take repo private (retaining star
by JadoJodo 5y ago
I don’t know for certain but I feel like this could allow something like 1. Takeover/inherit public repo with lots of stars 2. Take repo private (retaining stars) 3. Replace repo code with some malicious/offensive code. 4. Take repo public again 5. Inherit the trust/prestige of the old repo.
- sam0x17 5y agoYeah but it's not like stars are seen as some amazing endorsement on the part of the individual starring. It's more like a favorites list if anything
- freedomben 5y agostars absolutely are seen as an endorsement. I'm guilty of that for sure, and I've been in a ton of conversations about adopting some thing and the "number of stars" is often a consideration unless it's a project like React or Vue, etc. Would you really not look at two repos that do the same thing, with similar ages and recent commits but one has zero stars and the other has hundreds, and not at least initially trust the latter more?
- ninkendo 5y agoYou can do that without the “making it private and public again” part anyway.
- V__ 5y agoBut couldn't the same be achieved without taking it private?
- notreallyserio 5y agoYeah, that's a risk. They could mitigate it by allowing you to revert all branches/tags back to the pre-private state, but we're getting more and more complicated here.
- deleted 5y ago[deleted]