4 ms·

Because GitHub can serve different bytes to different people. You log in as one of the project's devs, you get your own consistent, correct view of your project

Because GitHub can serve different bytes to different people. You log in as one of the project's devs, you get your own consistent, correct view of your project; some other people get malware instead. How do you reconcile the full picture? No one distrusts GitHub. There's no public log which git tools generically check against to see if GitHub is attempting something evil, the way they do with certificate transparency. GitHub is the public log. Git may be designed as a distributed VCS; and it'd be a different situation if it were used that way in practice. For many projects, GitHub has a full MITM. They could even—forget about the checksums—bifurcate the views in between devs—accept commits from one dev, send over those commits with translated Merkle trees to another dev who has a corrupted history, and they'd never figure it out.

saagarjha 1y ago
Yes, but the moment you try to push your local git will complain that you are not aligned with the upstream repo.
- perihelions 1y ago
  Not so. GitHub would remember who you are; advertise to you and to you only a set of fake checksums consistent with your fake view of the repo. Your git client would see nothing amiss—your local fake checksums are consistent with the fake checksums the server sent you. Having accepted your push, the server would ignore the fake checksums, extract the content of your patch, apply it to the genuine repo, and compute a new set of checksums, extending the other checksum tree as if you had pushed directly to it. That's what an MITM is.
  - saagarjha 1y ago
    This falls apart instantly if you share a hash with anyone else, though. Which is exactly what happens when you send in a PR
    - account42 1y ago
      Most projects on GitHub have you submit PR's via GitHub infrastructure so they have total control over who sees what there as well.
BobaFloutist 1y ago
What happens when a dev tries to patch a bug in the malware and nobody can tell what the hell they're talking about?

saagarjha 1y ago

Yes, but the moment you try to push your local git will complain that you are not aligned with the upstream repo.

perihelions 1y ago
Not so. GitHub would remember who you are; advertise to you and to you only a set of fake checksums consistent with your fake view of the repo. Your git client would see nothing amiss—your local fake checksums are consistent with the fake checksums the server sent you. Having accepted your push, the server would ignore the fake checksums, extract the content of your patch, apply it to the genuine repo, and compute a new set of checksums, extending the other checksum tree as if you had pushed directly to it. That's what an MITM is.
- saagarjha 1y ago
  This falls apart instantly if you share a hash with anyone else, though. Which is exactly what happens when you send in a PR
  - account42 1y ago
    Most projects on GitHub have you submit PR's via GitHub infrastructure so they have total control over who sees what there as well.

BobaFloutist 1y ago

What happens when a dev tries to patch a bug in the malware and nobody can tell what the hell they're talking about?