We could at least reference a known good version by hash. This is at least a little more secure. But considering that Github could have been compromised by thi

We could at least reference a known good version by hash. This is at least a little more secure. But considering that Github could have been compromised by this bug, I would probably not pipe much from them until I know more about them not being compromised. Isn't running a jailed git server over ssh one of the great exploits of this bug?