3 ms·
Interesting solution, but is this really a problem? The only situations I can think this applies to are large-scale open-source projects with many maintainers,
by eykanal 14y ago
Interesting solution, but is this really a problem? The only situations I can think this applies to are large-scale open-source projects with many maintainers, and even more people submitting patches. For closed-source projects without external patch submissions, this is really only avoids the security threat of someone sitting at your computer and committing malicious code to your repository, which (to me) doesn't sound like much of a threat. (At least, if that is a threat, rogue commits to your git repo are only one part of your problem, and door locks would probably be a better, more broadly beneficial solution than implementing this.)
- nknight 14y agoCorporate networks get broken into all the time. Any machine that a copy of the repository is stored on is a potential attack vector. Various strategies are used to specifically protect all kinds of sensitive systems far beyond simple network security. This article is a detailed exploration of a/some strategy/ies for protecting your git repository against malicious modification -- a scenario that is rare but far from unprecedented.
- wyck 14y agoYes of course, creating a backdoor or sabotage via revision control is a really good attack vector (like really). Recently several large open source projects had shady forged commits, so it's safe that say that anything private is also being targeted.
- MattJ100 14y agoApart from Ruby, which?
- Jebus 14y agoYou mean Rails.
- marshray 14y agoWordpress http://wordpress.org/news/2011/06/passwords-reset/ http://wordpress.org/news/2011/06/passwords-reset/
- rmc 14y agoI presume your talking about the github incident. As far as I know that was just a proof of concept. There wasn't an actual, malicious, black hat forged commit, was there?