Hacker News Reader

It seems they use some combination of gitolite and their own stuff.

The post mentions karma, there's some code here: https://github.com/php/karma/

Thanks. That's a bit of a relief, given that we use self-hosted GitLab instances.

Well it's still vulnerable. At least in Gitlab you can use fancy features like requiring 2FA for members of a group. But you still need to secure its infrastructure.

I think the most common attacks on Github repos and groups have been on individual accounts. Which 2FA would mitigate.

> Which 2FA would mitigate.

Or Rust, right? </sarcasm> https://github.com/php/karma/search?q=exec

Reply on news.ycombinator.com