back
1 comments
I might not be able to explain well, but from what I understand about how github works, when you fork someone else's repo, github only stores 1 tree but you have your own set of tags / branches. This led to an issue that was probably fixed where if you set a repo to private, anyone who had a clone could guess commit hashes from their fork's remote. Another interesting thing about git is that you can have 2 root commits (the Linux kernel has 4 root commits iirc).

Because of these 2 "features", when I clone dmca and run `git pull some_ytdl_git_mirror master --allow-unrelated-histories`, I end up with a giant source tree that consists of both repos joined by a merge commit. Because no rebasing happened, no history was changed and it can be pushed without force permissions. Now that all the youtube-dl commits are in the same tree as the dmca repo, you can access them regardless of what fork you've cloned via `git fetch origin <hash>`.

I hope that makes sense?

Nice comment. I'm sipping coffee and much to my shame i thought this was going to be some meta joke about screwing with some sort of master list of DMCA'd repos on Github or something. Sipping coffee, reading comments, chillin.. then read yours, and almost spit it out at how much funnier this is than i thought it was.

I re-opened the link and actually used my eyeballs, and yup.. it's the damn Youtube-dl library on the /dmca repo, bahaha. I almost whooshed the joke entirely, so thanks :)

This seems like a security issue, no?
It is a security issue if the presence of a commit or tree in a repo is supposed to be enough to get GitHub to nuke the repo, as this then allows malicious users to convince GitHub to nuke any repo they like, but GitHub can instead deal with this more sensibly and not make it a security issue.
It could indeed be a security issue. A few options:

- Make a PR to a project that changes e.g. one of the dependencies to typosquatted alternatives. Disguise the commit message as something trivial. Post it to HN with a GH link to the upstream project's repo at your commit.

- Make a PR to a project that adds malicious code, suggest a change to a distro package's source repo to use your commit. Unless the maintainers know about this GitHub behavior, that'll look much more trivial than it actually is.

Seems to me like you could ddos a repo this way, though I guess that would be true of any pr spamming?