11–20 of 79 posts
This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?
Correct. My suggestion for a solution is for github to add a "reject-unsigned" feature. Only allow commits signed by and to be pushed to github, under any projects/org.
You're just adding an extra step that's hardly going to stop someone.
Huh? What does that mean?
Earlier quoted context omitted.
Correct. My suggestion for a solution is for github to add a "reject-unsigned" feature. Only allow commits signed by and to be pushed to github, under any projects/org.
How does this solution solve the problem? You're just adding an extra step that's hardly going to stop someone.
This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?
Correct. My suggestion for a solution is for github to add a "reject-unsigned" feature. Only allow commits signed by and to be pushed to github, under any projects/org.
How would code like this make it into so many repos? People accepting pull requests and not properly reviewing them? Or is there something even worse about this attack?
Most of them don't seem to come from pull requests, I wonder if it's paired with a bunch of compromised github accounts?
This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?
This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?
Correct. My suggestion for a solution is for github to add a "reject-unsigned" feature. Only allow commits signed by and to be pushed to github, under any projects/org.
1. What happens when someone needs to resolve a merge conflict involving your commit? Let's say I maintain a fork of an open source repo to add some feature, and I periodically merge back in upstream changes... that necessarily involves resolving conflicts. By default, git retains author ownership, and now the commit is unsigned, but it's really your work. What do we do? Do I have to use a custom merge flow that also rewrites authorship from "Alice " to "Alice "?
2. What happens if your gpg key is compromised or expires? Are all your previous repos now invalid? I can't fork it because it contains a commit authored by you, but with a revoked or expired gpg key?
3. What happens to previous commits if I enable this feature? Can all my unsigned commits no longer be pushed to github? I made a commit in a project at work 5 years ago with my email, but didn't sign it.. if that company wants to open source that project on github, do they now have to rewrite history to change the author on my unsigned commits?
4. What does the "squash merge" button on github PRs do for your PRs?
Somebody should DDoS ovz1.j19544519.pr46m.vps.myjino.ru... (mostly kidding)