Re:YouTube-dl is now part of GitHub/dmca.git
by larose on Sunday October 25, 2020 @08:09AM
(#24885681)
Indeed. And you don't even need to create a PR to "inject" commits into a GitHub repo. You just need to fork it and push to your fork. See https://mathieularose.com/github-commit-injection
Re:YouTube-dl is now part of GitHub/dmca.git
by mschuster91 on Sunday October 25, 2020 @01:29AM
(#24884088)
yuck, yet another reason to get people to do commit signing - and enforce it by github not attributing unsigned commits.
Re:YouTube-dl is now part of GitHub/dmca.git
by steebchen on Sunday October 25, 2020 @01:19PM
(#24887936)
Does commit signing really solve this? I believe you can restrict branches to only allow signed commits, but since these commits are not in any branch on that repository it looks like that wouldn't change anything. Correct me if I'm wrong, though.
Re:YouTube-dl is now part of GitHub/dmca.git
by mschuster91 on Sunday October 25, 2020 @01:45PM
(#24888223)
That yes, but at least the github/gitlab/... UI could refuse to link unsigned comments to the userpage belonging to the email in the commit.
This basically means that any content can be injected into anyone's GH repo (since PRs can't be turned off), but really only in terms of being able to view it on the GitHub website. To give an example, pull 437 on torvalds/linux[0] hasn't been merged in, but if you go to the commit hash in the browser, suddenly main/init.c has the relevant changes and commit that condense the file into one line[1].
This very well could be abused - imagine framing (or just 'canceling') someone with [insert illegal content here] by PRing their repo with a commit with a forged author[2] then linking people to their repo with the commit tree showing the illegal content.
0: https://github.com/torvalds/linux/pull/437
1: https://github.com/torvalds/linux/blob/2793ae1df012c7c3f13ea...
2: https://stackoverflow.com/a/60900120/3878893