Earlier quoted context omitted.
Somebody on twitter took some screenshot https://twitter.com/dclauzel/status/1147525512794988544
Yes, somebody did ;)
Air France représente !
Canonical Ltd source code repositories have been compromised
31–40 of 78 posts
Re: Canonical Ltd source code repositories have been compromised
#32We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
> We are lucky that they decided to vandalize instead of hiding something. How on earth do you know they haven't done both?!
[deleted]
Re: Canonical Ltd source code repositories have been compromised
#33So... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?
Re: Canonical Ltd source code repositories have been compromised
#34Earlier quoted context omitted.
Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a…
Github could simply reject commits with email addresses not added to your account. As you need to verify every email you add to your account this problem would be solved instantly.
> Github could simply reject commits with email addresses not added to your account.
Sure, if GitHub wanted to completely abandon the decentralized nature of Git and be a completely centralized system. Which it would love to, I'm sure, but I don't think the user base is quite ready for them to completely shut off any repository with any commits not made by Github users, and posted to GitHub through the account of the user who made the commit, which is what you are suggesting.
Re: Canonical Ltd source code repositories have been compromised
#35So... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?
That's actually the important question that Canonical should answer ASAP.
Re: Canonical Ltd source code repositories have been compromised
#36Two people have been removed since this occured.
Re: Canonical Ltd source code repositories have been compromised
#37We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
> We are lucky that they decided to vandalize instead of hiding something. How on earth do you know they haven't done both?!
Git commit hashes are pretty safe.
Re: Canonical Ltd source code repositories have been compromised
#38Earlier quoted context omitted.
> We are lucky that they decided to vandalize instead of hiding something. How on earth do you know they haven't done both?!
Git commit hashes are pretty safe.
To verify old hashes, with a backup. But anyone with access can just push a new commit with an arbitrary author field. Without code signing it'd be very difficult to tell who actually pushed it. (Probably GitHub has logs you could check, but if the attacker could get on the corporate network it'd just be a NAT IP, and more sophisticated attackers can spoof or MITM)
Re: Canonical Ltd source code repositories have been compromised
#39We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
> We are lucky that they decided to vandalize instead of hiding something. We do NOT know this.
>> We are lucky that they decided to vandalize instead of hiding something.
> We do NOT know this.
Well, at least we know that the attackers wanted their activities to be noticed at this point in time.
I have reasons to suspect that this is a compromised account, in which case there should be enough forensics info to figure out what the scope of the damage is.
Re: Canonical Ltd source code repositories have been compromised
#40We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
Isn't commit signing a bit like NuGet package signing? Not worth it unless _everyone_ does it all the time? Any valid commit doesn't necessarily invalidate unsigned commits. It only means this commit is really done by me , but it doesn't me the other commit wasn't done by me.
When you sign git commit, you do not sign your diff but the whole source tree as you see it. Effectively, you're vetting all prior commits on the branch.
Thus maintainers usually sign merge commits and it's their job to confirm that commits don't do anything shady and come from people they claim to come from.