4 ms·
> malicious employee making a commit with obviously bad code in someone else's name, but with branch protections enabled, it wouldn't go to prod without someone
by shawabawa3 4y ago
> malicious employee making a commit with obviously bad code in someone else's name, but with branch protections enabled, it wouldn't go to prod without someone else catching it.
You are massively overconfident about the protections code review provides. But even if you _are_ confident in code reviews, you can push code to someone else's PR under their name, then approve it yourself and ship it yourself.
It also opens up social engineering vectors. Create a PR by CEO/CTO/Senior Security Engineer/whatever, with some critical sounding bug fix impacting $BIG_CLIENT, then you DM someone "hey, $IMPORTANT_PERSON needs this shipped ASAP, can you help us out with a quick +1?"
- Sohcahtoa82 4y agoIn both cases, you're leaving a paper trail that you were involved. In the first, you approved bad code. In the second, you asked someone to approve bad code. Of course, who knows how long that bad code could sit in prod before it gets noticed is a toss-up, and preventing it from happening is going to be infinitely better than just logging it. Got any other scenarios that commit signing would solve?