The Comforting Lie of SHA Pinning
vaines.org
The Comforting Lie of SHA Pinning
1–6 of 6 posts
Re: The Comforting Lie of SHA Pinning
#2Wow. I did not know this. I'll bring it up in my organization.
Re: The Comforting Lie of SHA Pinning
#3GitHub needs to support 'Immutable Release' on GitHub Actions, as soon as possible. Other methods are just workaround and easy to break just like example on the post.
Re: The Comforting Lie of SHA Pinning
#4TFA writes: "Late last year NPM was basically a skip fire" — is this an idiom I should know? (Something like a misfire?) Or a typo for "ship fire"? Or something else?
Re: The Comforting Lie of SHA Pinning
#5TFA writes: "Late last year NPM was basically a skip fire" — is this an idiom I should know? (Something like a misfire?) Or a typo for "ship fire"? Or something else?
Skip is british term for dumpster.
Re: The Comforting Lie of SHA Pinning
#6This has been a big security/UX issue with github for a while. It extends to the web interface: you can link to a specific commit under an official github repo but the contents of the README on the page will be from a malicious fork, which makes it way easier to make links look legitimate.