GitHub Is Making Open-Source Projects More Secure

Open source projects are an essential part of every operating system, and many software programs are either open source or rely on open source projects to function. But what happens when these projects are compromised by a malicious actor? GitHub is taking steps to prevent this.

Normally, when you upload a project to GitHub, you are free to modify that code at any time. In many cases, this makes sense: something in active development will usually need to be updated, adjusted, and debugged over time.

However, this ability to update code after it has been placed in a repository also provides a tempting attack vector for a malicious actor. If they can compromise the account of the repository owner (or anyone else authorized to make changes), they can replace legitimate existing code with something containing malware or an exploitable security vulnerability.

Nor is this a purely theoretical concern. Owners of popular projects on GitHub are attractive targets for bad actors, and they are sometimes compromised. This happens relatively frequently to small GitHub projects that are popular in niche communities. If these projects are then integrated into other projects, everything “downstream” of the initial project could be compromised.

If this were to happen to a project integrated into an operating system, it could affect millions or even billions of people.

So how do you prevent this from happening?

You’ll never create a foolproof way to prevent hackers from accessing someone’s account: social engineering will always work, at least. Instead, GitHub chose to focus on the code itself by making it immutable.

This means that once the code is uploaded to GitHub and the immutable feature is enabled, no one, not even the owner, can come back and quietly make a change later. It also allows users to manually verify that the code they download matches the original code, just in case. This means that even if someone gains full control over the repository owner’s account, they will not be able to add, modify, or delete existing code for their own nefarious purposes.

This is a great addition that will make large open source projects more secure in the future, provided people bother to enable it.

Source: GitHub