2 ms·
Gitlab's approach also sounds like an easy way to hijack dormant projects to inject malicious code and let unsuspecting users download "updates"
by trinovantes 4y ago
Gitlab's approach also sounds like an easy way to hijack dormant projects to inject malicious code and let unsuspecting users download "updates"
- L6489afSMNLNFDa 4y agoExcept that projects are namespaced under their owner, so you'd need to hijack the owner's account. They don't appear to have been proposing deleting users (or groups), just projects. Other than that, you can fork whatever you want today...
- trinovantes 4y agoOP is talking about obtaining an username from an inactive user. If they were able to obtain the username, they effective took over the namespace.