user/dev discussion of public-inbox itself
 help / Atom feed
From: Arif Khokar <arif_khokar@hotmail.com>
To: Johannes Schindelin <Johannes.Schindelin@gmx.de>,
	Arif Khokar <arif_khokar@hotmail.com>
Cc: Philip Oakley <philipoakley@iee.org>,
	Duy Nguyen <pclouds@gmail.com>, "Jeff King" <peff@peff.net>,
	Stefan Beller <sbeller@google.com>,
	"meta@public-inbox.org" <meta@public-inbox.org>,
	"git@vger.kernel.org" <git@vger.kernel.org>,
	Eric Wong <e@80x24.org>, Jakub Narębski <jnareb@gmail.com>
Subject: Re: Working with public-inbox.org [Was: [PATCH] rev-parse: respect core.hooksPath in --git-path]
Date: Thu, 25 Aug 2016 23:14:12 +0000
Message-ID: <DM5PR17MB13536B19149ABF86ECD07E1AD3ED0@DM5PR17MB1353.namprd17.prod.outlook.com> (raw)
In-Reply-To: <alpine.DEB.2.20.1608251500210.4924@virtualbox>

On 08/25/2016 09:01 AM, Johannes Schindelin wrote:
> Hi Arif,
>
> On Thu, 25 Aug 2016, Arif Khokar wrote:

>>> I considered recommending this as some way to improve the review process.
>>> The problem, of course, is that it is very easy to craft an email with an
>>> innocuous patch and then push some malicious patch to the linked
>>> repository.
>>
>> It should be possible to verify the SHA1 of the blob before and after
>> the patch is applied given the values listed near the beginning of the
>> git diff output.
>
> There is no guarantee that the SHA-1 has not been tampered with.

I was implying that the resulting SHA1 of the blob after the malicious 
patch was applied would differ compared to the resulting blob after 
applying the innocuous patch.  Even if you alter the SHA1 value within 
the patch itself, it doesn't change the SHA1 of the result (unless 
you're able to get a hash collision).

But, if you want to guarantee that the SHA1 hasn't been tampered in the 
email, you could sign it with your private GPG key and others could 
verify the signature with your public key (assuming the web-of-trust 
applies).

  reply index

Thread overview: 64+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-08-16 16:55 Stefan Beller
2016-08-16 17:10 ` Junio C Hamano
2016-08-16 17:20   ` Jeff King
2016-08-16 17:54     ` Junio C Hamano
2016-08-16 17:22   ` Stefan Beller
2016-08-16 17:47     ` Junio C Hamano
2016-08-16 20:44   ` Eric Wong
2016-08-16 20:56     ` Eric Wong
2016-08-18 12:42 ` Johannes Schindelin
2016-08-18 20:49   ` Eric Wong
2016-08-18 21:41     ` Junio C Hamano
2016-08-19 15:18       ` Johannes Schindelin
2016-08-19 15:30     ` Johannes Schindelin
2016-08-19 16:55       ` Stefan Beller
2016-08-19 22:35         ` Eric Wong
2016-08-22 13:38         ` Johannes Schindelin
2016-08-22 19:21         ` Jeff King
2016-08-19 22:35       ` Eric Wong
2016-08-22 13:18         ` Johannes Schindelin
2016-08-22 18:05           ` Jakub Narębski
2016-08-25 13:21             ` Johannes Schindelin
2016-08-28 18:23               ` Jakub Narębski
2016-08-29 10:46                 ` Johannes Schindelin
2016-08-22 22:55           ` Eric Wong
2016-08-25 12:58             ` Johannes Schindelin
2016-08-27 22:38               ` Jakub Narębski
2016-08-28  8:36                 ` Working with public-inbox.org Johannes Schindelin
2016-08-28 11:41                   ` Jakub Narębski
2016-08-29  5:35                     ` Johannes Schindelin
2016-08-19 15:03   ` Working with public-inbox.org [Was: [PATCH] rev-parse: respect core.hooksPath in --git-path] Jeff King
2016-08-20 19:57     ` Jakub Narębski
2016-08-23  4:47       ` Arif Khokar
2016-08-24 15:34         ` Johannes Schindelin
2016-08-24 18:49           ` Eric Wong
2016-08-24 19:12             ` Jeff King
2016-08-24 19:27               ` Eric Wong
2016-08-25  3:40             ` Arif Khokar
2016-08-25  2:41           ` Arif Khokar
2017-02-10 16:10           ` Johannes Schindelin
2017-02-13  5:52             ` Arif Khokar
2017-02-13 14:37               ` Johannes Schindelin
2017-02-14  3:56                 ` Arif Khokar
2017-02-14  3:59                   ` Arif Khokar
2017-02-14  7:13                   ` Eric Wong
2017-02-13 19:21               ` Junio C Hamano
2017-02-14  3:55                 ` Arif Khokar
2017-02-14  4:41                   ` Junio C Hamano
2017-02-14  5:09                     ` Arif Khokar
2017-02-14  5:14                     ` Jeff King
2016-08-22 13:06     ` Johannes Schindelin
2016-08-22 13:15       ` Duy Nguyen
2016-08-22 20:38         ` Philip Oakley
2016-08-24 13:04           ` Johannes Schindelin
2016-08-24 19:16             ` Eric Wong
2016-08-25 13:08               ` Johannes Schindelin
2016-08-25  3:57             ` Arif Khokar
2016-08-25 13:01               ` Johannes Schindelin
2016-08-25 23:14                 ` Arif Khokar [this message]
2016-08-26  8:08                   ` Johannes Schindelin
2016-08-27 22:26         ` Jakub Narębski
2016-08-28  8:38           ` Johannes Schindelin
2016-08-28 13:45             ` Announcing Git User's Survey 2016 [was: Working with public-inbox.org] Jakub Narębski
2016-09-09 13:06               ` Johannes Schindelin
2016-09-09 18:51                 ` Jakub Narębski

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://public-inbox.org/README

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=DM5PR17MB13536B19149ABF86ECD07E1AD3ED0@DM5PR17MB1353.namprd17.prod.outlook.com \
    --to=arif_khokar@hotmail.com \
    --cc=Johannes.Schindelin@gmx.de \
    --cc=e@80x24.org \
    --cc=git@vger.kernel.org \
    --cc=jnareb@gmail.com \
    --cc=meta@public-inbox.org \
    --cc=pclouds@gmail.com \
    --cc=peff@peff.net \
    --cc=philipoakley@iee.org \
    --cc=sbeller@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

user/dev discussion of public-inbox itself

Archives are clonable:
	git clone --mirror https://public-inbox.org/meta
	git clone --mirror http://czquwvybam4bgbro.onion/meta
	git clone --mirror http://hjrcffqmbrq6wope.onion/meta
	git clone --mirror http://ou63pmih66umazou.onion/meta

Newsgroups are available over NNTP:
	nntp://news.public-inbox.org/inbox.comp.mail.public-inbox.meta
	nntp://ou63pmih66umazou.onion/inbox.comp.mail.public-inbox.meta
	nntp://czquwvybam4bgbro.onion/inbox.comp.mail.public-inbox.meta
	nntp://hjrcffqmbrq6wope.onion/inbox.comp.mail.public-inbox.meta
	nntp://news.gmane.org/gmane.mail.public-inbox.general

 note: .onion URLs require Tor: https://www.torproject.org/
       or Tor2web: https://www.tor2web.org/

AGPL code for this site: git clone https://public-inbox.org/ public-inbox