3 ms·

How does this solution solve the problem? You're just adding an extra step that's hardly going to stop someone.

• stevelacy 4y ago
  It would only allow commits signed by me to be pushed under my email. Github uses the email as the "proof" of commit ownership. By only accepting signed commits a user would not be able to push a commit impersonating me.
  • irjustin 4y ago
    That solves impersonation, but that is not a related problem here. These repos were not taken over but cloned and made to look like another repo via similar naming. I think what you're looking for is more "all accounts must be verified via payment/identity" then you really know who is making "random clones" and "look-a-likes" w/ malware. But you've got a whole host of other problems in the process.