{"thread":{"id":"24675","subject":"rejected updates/pushes can be found on remote","startedAt":"2010-08-09T04:54:33Z","lastAt":"2010-08-09T04:54:33Z","messageCount":1,"participants":["Richard Bronosky"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"147482","messageId":"AANLkTingxD_VTpmMZ+u=KXtY16DjpksxmGGKuO0B219q@mail.gmail.com","threadId":"24675","inReplyTo":null,"subject":"rejected updates/pushes can be found on remote","fromName":"Richard Bronosky","fromEmail":"richard@bronosky.com","sentAt":"2010-08-09T04:54:33Z","receivedAt":"2010-08-09T04:54:33Z","isPatch":false,"sender":{"key":"richard@bronosky.com","avatar":null},"body":"I don't know if this is evil or not. I just find it interesting. If\nyou have and update hook on the remote that returns non-zero,\nrejecting a push, you can later find the hash (on the remote). I'm\nglad it get to the remote because I do \"git diff --name-only $2 $3\" to\ndecide whether or not to accept. But, I wonder if most people are\naware that it hangs around until it is garbage collected. This could\npotentially be an attack vector, or at least a liability. (Imagine\nsome IP troll uploading their code to you and subpoenaing your\nserver.)\n\n-- \n.!# RichardBronosky #!.\n"}]}