this post was submitted on 02 Mar 2024
240 points (98.0% liked)
Technology
58159 readers
3438 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
No, it's not. Not in literally any way. Not 1%. Not 0.000000000000000001%. You don't even get security by obscurity as a nebulous benefit because the core mechanisms are basically the same between instances.
No projects are being compromised. They're being imitated and passed off as the real thing to the naive. You can just as easily do that on another server (including established ones by adding multiple domains to your scripts) when people expect to use thousands of different git hosts as you can on GitHub, except without the benefit of the scale of Microsoft's expertise at handling this type of attack.
I'm all for federated git being the way forward. I'd love to see it grow into a reasonable option. But it has no benefit in any context against an attack like this.
a decentralized community that correctly prioritizes security would absolutely be using signed commits and other web-of-trust security practices to prevent this sort of problem
New accounts exist and have good reason to exist. You can't and shouldn't ban new accounts from creating projects.
Anyone capable of understanding what "web of trust" means is already way too sophisticated to be misled by these fake projects.