Hacker News new | ask | show | jobs
by BoberMod 2053 days ago
Commit is not signed, it could have been anyone, just by changing the email/username in gitconfig.
1 comments
ocdtrekkie 2053 days ago
Is it the actual source code then? Was it an internal leaker or was GitHub's repo compromised? I have so many questions.
link
Karunamon 2053 days ago
It's the actual source code, but this is the result of two known WONTFIX issues on GitHub:

* Any commit can be attributed to any user on the site by way of the author/committer fields in git. No authentication or checking is done.

* Any content can be attached to any repository that accepts pull requests, and will be accessible on that repository's url if you have its hash (previous discussion: https://news.ycombinator.com/item?id=24882921)

More civil disobedience than hack, really.

link
jsheard 2053 days ago
GitHub allows enterprise customers to run their own GitHub instance on-premises, so any one of those could have peeked inside the VM and pulled out the source code.

https://enterprise.github.com/faq

link