News for hackers. Stuff that matters.

A comment on Malicious code added to 35k GitHub repos, leaking user environments. Parent comment

Re:Malicious code added to 35k GitHub repos, leaking user en... by stevelacy on Wednesday August 03, 2022 @02:10AM (#32328193)
It would only allow commits signed by me to be pushed under my email. Github uses the email as the "proof" of commit ownership. By only accepting signed commits a user would not be able to push a commit impersonating me.
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by irjustin on Wednesday August 03, 2022 @03:43AM (#32328763)
That solves impersonation, but that is not a related problem here.

These repos were not taken over but cloned and made to look like another repo via similar naming.

I think what you're looking for is more "all accounts must be verified via payment/identity" then you really know who is making "random clones" and "look-a-likes" w/ malware.

But you've got a whole host of other problems in the process.

[ Parent | on HN ]