logoalt Hacker News

odo1242 • today at 7:15 AM • 1 reply • view on HN

In GitHub, fork networks are represented as one repo on disk (this is the main optimization that makes community pull requests possible at all). So you could fork a repo and then push an object with a hash collision to it to change a file in the original, in theory.

(In practice this is harder, as the article mentions, because the new forged object would have to be a valid gzipped git object of the same length. And GitHub probably knows about this type of attack and might just, for example, prevent existing objects from being overwritten)


Replies

Dylan16807 • today at 7:37 AM

You also have to trick the code git added to detect and block shattered-style attacks.

Still, eliminating the risk is a good idea.