3 ms·

I think it would be rather easy to infiltrate a development team, especially a geographically distributed one.

• patio11 13y ago
  This is a movie plot threat. Most vulnerabilities in software are not caused by suborning one of the developers -- developers create vulnerabilities all the time without being subject to adversarial action. The adversarial actor just has to look at the software artifact created and find things about it that the original developer does not realize are true.
• unreal37 13y ago
  What about cracking the password to one of those people's Git account, and then submitting a commit without anyone knowing? What if Github is compelled by a National Security Letter to allow others to modify source files and erase the logs for those changes? What if one of those guys is the next Sabu - facing 50 years in jail unless they cooperate?
  • estebank 13y ago
    You realize that you cannot modify a commit's content without modifying the commit hash for every subsequent commit? Your attack would be practically impossible against a git repo.
• anotherhue 13y ago
  There's a possibility that a developer acted in bad faith, for the sake of love, money, or fear. I have no reason to think that this has happened, but since it is possible, and the code is open, we can check.