Hacker News Reader

How does this solution solve the problem?

You're just adding an extra step that's hardly going to stop someone.

It would only allow commits signed by me to be pushed under my email. Github uses the email as the "proof" of commit ownership. By only accepting signed commits a user would not be able to push a commit impersonating me.

That solves impersonation, but that is not a related problem here.

These repos were not taken over but cloned and made to look like another repo via similar naming.

I think what you're looking for is more "all accounts must be verified via payment/identity" then you really know who is making "random clones" and "look-a-likes" w/ malware.

But you've got a whole host of other problems in the process.

Reply on news.ycombinator.com