3 ms·
Is disabling the compromised repo the typical GitHub policy? My concern is there are monorepos used by package managers, like brew, that are a collection of tho
by hgs3 3y ago
Is disabling the compromised repo the typical GitHub policy? My concern is there are monorepos used by package managers, like brew, that are a collection of thousands of projects [1]. These monorepos seem like a prime target for attack and if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem.
[1] https://github.com/Homebrew/homebrew-core https://github.com/Homebrew/homebrew-core
- gertop 3y ago> if GitHub disables one because a malicious commit was merged then you've taken down an entire ecosystem. Maybe that should be an opportunity for introspection into the house of card we've collectively built as software engineers.
- raincole 3y agoMaybe Github should at least move it to a new URL so people can learn from this security case first hand.
- kelnos 3y agoMaybe we shouldn't rely on a corporation owned by Microsoft (of all companies, jeez) for essential parts of our open-source infrastructure.
- J-Kuhn 3y agoWe know that we build a house out of cards: https://xkcd.com/2347/ https://xkcd.com/2347/
- onionisafruit 3y agoIt’s been a few years since I worked there, but I suspect situations like this are still played by ear. They may have run books for it now, but I think human judgement is still a significant factor.
- soneil 3y agoI don't think the situation is very typical, so I don't why the response should be. There's two maintainers, one is on an "internet hiatus", the other is either suspected of being the bad actor, or is otherwise so thoroughly compromised to destroy any short-term trust. I assume if homebrew had such an egregious issue, they'd have someone able to respond to it.
- e40 3y agoAnyone know if Homebrew is impacted? I literally updated yesterday.
- e40 3y agoThe answer is definitely. Just updated and saw this: xz 5.6.1 -> 5.4.6 More details for Homebrew users: https://github.com/orgs/Homebrew/discussions/5243#discussioncomment-8954951 https://github.com/orgs/Homebrew/discussions/5243#discussion...