[AtNightWeCode]

People think git is immutable. It is not.

[Lichtso]

Yes and no.

A local GIT repo can be changed (including its history) however you please. But once you have shared it with others you can't take that back. If you try to, then others will notice that the hashes mismatch and that their HEAD diffs uncleanly.

I know the term is infamous here, but GIT is essentially a blockchain. Each commit has a hash, which is based on the hashes of previous commits, forming a linked list (+ some DAG branching).

[The_Colonel]

> If you try to, then others will notice that the hashes mismatch and that their HEAD diffs uncleanly.

So it relies on a human noticing and acting upon it. People not noticing backdoors being merged into the project is kinda the source of this problem.

[fl7305]

You can automate checks for if a large part of the previous git history suddenly changed.

You can't automate checks for malicious code.

[The_Colonel]

That relies on some heuristics which can be worked around, unless you disallow rewriting history.

But the bigger issue is that this is some theoretical system which is not present in most git repositories.

[fl7305]

The heuristic would be "sound the alarm if the main branch is rewritten". And maybe also "if a release tag that we have used for our distro is moved".

Wouldn't that catch most problems, and not generate too many false alarms?

[The_Colonel]

You can rename/switch branches. You can change what branch is considered main/master. You can find valid reasons why you'd want to do stuff which raises the alarms so that other people become deaf to them, and only then execute the rewriting attack. Relying on people noticing (even with alarms) is just super fragile.

[craftkiller]

Its a Merkle Tree. They were invented 3 years before blockchains: https://en.wikipedia.org/wiki/Merkle_tree

[Lichtso]

It also uses a Merkle tree to compress the snapshot versions associated with commits. But the actual commit structure builds on top of that. A pure Merkle tree or forest would only give you a set of overlapping snapshots, without any directionality. So, I think it is fair to call it a blockchain as well.

[dboreham]

Blockchains were invented in 1982?

[Lichtso]

In short, yes: https://en.wikipedia.org/wiki/Blockchain#History

People conflate blockchains, distributed networks and cryptocurrencies.

[ptx]

Well, it is and it isn't: It has mutable pointers (branches and tags) to immutable nodes in a graph (commits).

[fl7305]

Can you elaborate? Are you thinking of intentional SHA-1 has collisions? Would that work in practice?

[AtNightWeCode]

The history. Every time something like this attack happens people think they can read the complete git history in the repo.

[fl7305]

If some commits are signed by people you trust, can the chain before that still be compromised?