4 ms·

> MITM for GitHub or another code forge is one of the things I'm least concerned about, because GitHub to me is a place where things go to be made public. This

by cesarb 3y ago

> MITM for GitHub or another code forge is one of the things I'm least concerned about, because GitHub to me is a place where things go to be made public. This is not just about secrecy, but also about integrity. Someone who MITMs your connection could not only look at the code you published, but also modify it. Then later someone who was trusting you (or possibly even yourself on a new machine) will end up downloading and running the modified code.

seabass-labrax 3y ago
In this particular case, I'm not sure it would be possible to modify the code in transit, because although you could trick the user into submitting the code into Fake GitHub, you wouldn't be able to authenticate as the user to submit your modified copy to Real GitHub. More importantly, in my opinion, the end-user has no way of verifying the integrity of the code if authentication was the only security measure. By signing releases or the commits themselves (which can be done with both PGP and SSH keys currently) the end-user can verify the integrity themselves.