GitHub source code in DMCA repo pushed by GitHub CEO
web.archive.org
GitHub source code in DMCA repo pushed by GitHub CEO
1–10 of 18 posts
Re: GitHub source code in DMCA repo pushed by GitHub CEO
#2Why is it committed by nat himself? I assume it's a tease of github source code being open sourced similar to GitLab?
Re: GitHub source code in DMCA repo pushed by GitHub CEO
#3Why is it committed by nat himself? I assume it's a tease of github source code being open sourced similar to GitLab?
I bet on a hack.
Re: GitHub source code in DMCA repo pushed by GitHub CEO
#4Re: GitHub source code in DMCA repo pushed by GitHub CEO
#5Why is it committed by nat himself? I assume it's a tease of github source code being open sourced similar to GitLab?
Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.
Re: GitHub source code in DMCA repo pushed by GitHub CEO
#6Why is it committed by nat himself? I assume it's a tease of github source code being open sourced similar to GitLab?
Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.
Is it the actual source code then? Was it an internal leaker or was GitHub's repo compromised? I have so many questions.
Re: GitHub source code in DMCA repo pushed by GitHub CEO
#7It's not actually pushed to the DMCA repo, it's pushed to a fork. GitHub will show the commit from the fork as if it's from the main repository if you specify the commit hash in the url. See this comment from yesterday for more details [1], with a proof of concept on the linux kernel repo [2].
[1] https://news.ycombinator.com/item?id=24976138 [2] https://github.com/torvalds/linux/tree/5895e21f3c744ed9829e3...
Re: GitHub source code in DMCA repo pushed by GitHub CEO
#8Sorry I'm confused - what are the implications of this?
Re: GitHub source code in DMCA repo pushed by GitHub CEO
#9Earlier quoted context omitted.
Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.
Is it the actual source code then? Was it an internal leaker or was GitHub's repo compromised? I have so many questions.
It's the actual source code, but this is the result of two known WONTFIX issues on GitHub:
* Any commit can be attributed to any user on the site by way of the author/committer fields in git. No authentication or checking is done.
* Any content can be attached to any repository that accepts pull requests, and will be accessible on that repository's url if you have its hash (previous discussion: https://news.ycombinator.com/item?id=24882921)
More civil disobedience than hack, really.
Re: GitHub source code in DMCA repo pushed by GitHub CEO
#10Earlier quoted context omitted.
Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.
Is it the actual source code then? Was it an internal leaker or was GitHub's repo compromised? I have so many questions.
GitHub allows enterprise customers to run their own GitHub instance on-premises, so any one of those could have peeked inside the VM and pulled out the source code.