News for hackers. Stuff that matters.

A comment on Sign arbitrary data with your SSH keys. Parent comment

Re:Sign arbitrary data with your SSH keys by drran on Saturday November 13, 2021 @08:47AM (#29209671)
GitHub can alter the CODE. Why it should play with just a key? If GitHub wants to pwn the whole world, it can do it right now.
[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by fortran77 on Saturday November 13, 2021 @09:32AM (#29209976)
Well, github will already shut down repositories that contain words that they deem unacceptable. So they are doing it now...

https://news.ycombinator.com/item?id=9966118

[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by judge2020 on Saturday November 13, 2021 @09:51AM (#29210117)
GH specifically going out of their way to falsify keys of a user would be a much bigger breach of trust than just shutting down repos. They know ssh-import-id-gh is a thing and people use it.
[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by flir on Saturday November 13, 2021 @09:17AM (#29209873)
Can't argue with that, except to say "because it's bad, lets make it worse" doesn't feel like a good rule of thumb.
[ Parent | on HN ]