Hacker News Reader

The culprit would now have the ability to merge pull requests and make changes to the open source codes master branch. So if one of these owner accounts was hacked. Then yes this is a hack.

View on HN

Sure, but isn't the point of git to be able to roll back all changes on any branch? And since GitHub is owned by Microsoft, they themselves would surely be able to regain ownership of the account.

This seems like a non-story.

How much code with malicious modifications has been pulled from these repos since then? There's no evidence this happened, but we can't just handwave it away with "we can undo changes".

Having openpgp-signed commits would prevent such an issue.

Would it?

Couldn't the "hacker" have simply generated a new GPG key and added it to the account he had control of?

The users would have specific keys trusted.

Reply on news.ycombinator.com