News for hackers. Stuff that matters.

A comment on Unauthorized code in Juniper ScreenOS allows for administrative access. Parent comment

Re:Unauthorized code in Juniper ScreenOS allows for administ... by mikeash on Friday December 18, 2015 @10:01AM (#10758772)
Shouldn't the server log incoming pushes so you can find when the commit arrived, not just when the commit claims to have been made?

Maybe they don't, but this seems like something they ought to do.

[ Parent | on HN ]
Re:Unauthorized code in Juniper ScreenOS allows for administ... by beagle3 on Friday December 18, 2015 @10:32AM (#10758931)
You could have them do it, but it's just going deeper down the rabbit hole. The eventual question is "who/what do you trust?" - maybe it was the git server that got pwned?

A PGP-signed commit with a key generated on a smartcard (and never exposed) is a little better, but ... Someone pwned RSA before, and I'd be surprised if Gemalto and Yubico (just two examples) don't have some Three-Letter-Agency backdoor (and .. I'm sure those TLAs have equipment that can read modern smartcards).

[ Parent | on HN ]
Re:Unauthorized code in Juniper ScreenOS allows for administ... by w_t_payne on Friday December 18, 2015 @12:39PM (#10759671)
Difference between CMS & VCS.
[ Parent | on HN ]