Malicious code added to 35k GitHub repos, leaking user environments

Re:Malicious code added to 35k GitHub repos, leaking user en... by jhugo on Wednesday August 03, 2022 @02:59AM (#32328500)

git is effectively a blockchain. Trying to use a blockchain for this has many of the same problems as described in GP's comment.

[ Parent | on HN ]

Re:Malicious code added to 35k GitHub repos, leaking user en... by 3np on Thursday August 04, 2022 @03:03AM (#32340043)

A blockchain could be useful for proving a commit was not done significantly before or after the claimed timestamp, and (depending on how you do it) non-repudiation.

IMO I don't see how this is desirable enough to be worth it.

Wider adoption of GPG signatures would be much more impactful.

It could make sense to use a blockchain for key distribution/key discovery/revocation, effectively as a replacement of PKI, though.

[ Parent | on HN ]