A Git horror story: faking provenance with a loose nonce | Hacker News Reader