Hacker News Reader

I have often wondered this myself. Considering if github was ever compromised, could an attacker modify your source code without your knowledge. Seems like a holy grail of attacks.

What would be interesting if there was some at-rest encryption and maybe some audit functionality.

View on HN

You would notice, the hash of the commit would change and you would get an error message in Git. If this is a vector attack your are worried about, you should sign Git tags with your PGP key and then you would notice any change in the history, each commit depends on its ancestors so signing a tag ensure no older commit can be changed too.

Hashes, while sometimes clumsy[0], are an advantage in this instance over, say, SVN or CVS (which use monotonicly increasing commit IDs).

[0]: Every time I want to find a commit’s parent(s) in Git, I have to look up the command (I don’t do it often), whereas in SVN I could just subtract one.

Reply on news.ycombinator.com