4 ms·

Older versions of git would tell you the hashes were wrong. Implementations of git in other languages would tell you the hashes were wrong. Manually checking wo

by phaemon 13y ago

Older versions of git would tell you the hashes were wrong. Implementations of git in other languages would tell you the hashes were wrong. Manually checking would tell you the hashes were wrong. It's just not feasible. EDIT: Plus, git is stored in git, so you'd need to backdoor git first... ;)

jerf 13y ago
Also, the source of git would also reveal a problem when examined. To get around that one starts hypothesizing the sort of globe-spanning conspiracy against which one might as well give up ("well, maybe all my compilers (not just gcc, all of them) are also backdoored to backdoor themselves, and each other if you cross-compile, then backdoor git too...").
- damon_c 13y ago
  This summer: One man looked too deeply into the source code of his compilers and didn't like what he found.
  - jerf 13y ago
    Quickly, damon_c! To Kickstarter!
yuvadam 13y ago
Bootstrap operation from hell [1] [1] - https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23ca2e25604af290 https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23...
- ryanthejuggler 13y ago
  Thanks for the link... I've never read the README before, and it's very entertaining. Now I'm going to have "goddamn idiotic truckload of sh*t" echoing through my head all day
  - jzzskijj 13y ago
    I read, when the project was introduced, but forgotten it a long time ago. Goddamn Idiotic Truckload of Sh*t Hub, Inc. would make a memorable name for an incorporation.
TheCraiggers 13y ago
The kernel hasn't always been tracked in git though. How would we know something wasn't added before the source was imported into git?
- Aloha 13y ago
  Because before it was tracked by git, it was in bitkeeper, and it was likely in some other system before that.
  - TheCraiggers 13y ago
    I understand that. But what I don't know are the capabilities of those other, older systems that once tracked the kernel source. Do we have the same assurances there?
    - antocv 13y ago
      Great question. BitKeeper wasnt as good as git when it comes to changesets and introducing bugs, still it was founded on more social side of changes needing approvals. Before that it was CVS and for that its almost easy to introduce backdoors.

by phaemon 13y ago

jerf 13y ago

Also, the source of git would also reveal a problem when examined. To get around that one starts hypothesizing the sort of globe-spanning conspiracy against which one might as well give up ("well, maybe all my compilers (not just gcc, all of them) are also backdoored to backdoor themselves, and each other if you cross-compile, then backdoor git too...").

damon_c 13y ago
This summer: One man looked too deeply into the source code of his compilers and didn't like what he found.
- jerf 13y ago
  Quickly, damon_c! To Kickstarter!

yuvadam 13y ago

Bootstrap operation from hell [1] [1] - https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23ca2e25604af290 https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23...

ryanthejuggler 13y ago
Thanks for the link... I've never read the README before, and it's very entertaining. Now I'm going to have "goddamn idiotic truckload of sh*t" echoing through my head all day
- jzzskijj 13y ago
  I read, when the project was introduced, but forgotten it a long time ago. Goddamn Idiotic Truckload of Sh*t Hub, Inc. would make a memorable name for an incorporation.

TheCraiggers 13y ago

The kernel hasn't always been tracked in git though. How would we know something wasn't added before the source was imported into git?

Aloha 13y ago
Because before it was tracked by git, it was in bitkeeper, and it was likely in some other system before that.
- TheCraiggers 13y ago
  I understand that. But what I don't know are the capabilities of those other, older systems that once tracked the kernel source. Do we have the same assurances there?
  - antocv 13y ago
    Great question. BitKeeper wasnt as good as git when it comes to changesets and introducing bugs, still it was founded on more social side of changes needing approvals. Before that it was CVS and for that its almost easy to introduce backdoors.