Re:Radicle: Open-Source, Peer-to-Peer, GitHub Alternative
by cloudhead on Tuesday March 05, 2024 @08:10AM
(#39602847)
Yeah, because for eg. I can publish the given repository from my server with an additional signed commit (signed by me) on top of the original history, and that commit could include a backdoor. You have no way of knowing whether this additional commit is "authorized" by the project leads/owners or not.
[ Parent
| on HN ]
Re:Radicle: Open-Source, Peer-to-Peer, GitHub Alternative
by xyzzy_plugh on Tuesday March 05, 2024 @10:39AM
(#39604791)
That is in fact the point, it's decentralized by nature. The entire idea behind git's decentralization is that your version with an additional backdoor is no lesser of a version than any other. You handle that at the pointer or address level i.e. deciding to trust your server.