Re: Question about scm security holes

From: Jakub Narebski <jnareb@gmail.com>
Date: Mar 5, 2010, 10:49 UTC
Message-ID: <m3lje7kpr9.fsf@localhost.localdomain>
In-Reply-To: <alpine.DEB.1.00.1003050953580.20986@pacific.mpi-cbg.de>

Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:

> On Thu, 4 Mar 2010, Avery Pennarun wrote:
> 
> > An attack in which someone untraceably modified the repo to contain 
> > modified code would be a little more interesting.

Show 8 quoted lines

> > git makes this sort of thing pretty much impossible to do without it 
> > being *noticeable* at least.
> 
> That is not true in all cases.
> 
> If you're talking about a workflow as git.git has it, you're right, there 
> is a maintainer, and a refused push would ring all kinds of alarm bells 
> there.

[...]

Show 5 quoted lines

> It gets even much, much worse in the common setup of companies: a central 
> repository. (The two main reasons why a central repository is used are: 
> tradition (we did it with Subversion, too), and bottleneck problems: a 
> single maintainer reviewing all changes is often deemed too expensive 
> and slow.)

About "bottleneck problem". Frederick Brooks wrote in his seminal book "The Mythical Man-Month" that recommended way of organizing teams is *with a maintainer*. But this is less known that his most famous statement: "Adding manpower to a late software project makes it later." (The Brooks's Law)... and I guess companies do not know about this one either :-)

-- 
Jakub Narebski
Poland
ShadeHawk on #git