Re:GitHub mirror compromise incident report
by swsieber on Thursday July 05, 2018 @01:21AM
(#17461028)
The wouldn't have even had to push smaller changes - there are ways in git to do a commit that basically overwrites the current state of the branch, but doesn't require a force push. We use it where I work when promoting branches (e.g. to production branch) so that we never ever have to worry about merge conflicts or force pushing. It's a merge strategy that basically says "When merging, just use parent 1, and pretend parent 2 doesn't exist when calculating files, etc."
Suggesting that this is "merely" a mirror downplays how seriously a more sneaky attacker could have harmed users of the project. Would similar statements downplaying the attack be made if this had been https://mirrors.kernel.org/ ?