Re: Tricking peer review

[Liliana Marie Prikler]

Am Freitag, den 15.10.2021, 22:28 +0000 schrieb Ryan Prior:
> On Friday, October 15th, 2021 at 10:03 PM, Liliana Marie Prikler <
> liliana.prikler@gmail.com> wrote:
> 
> > > On the plus side, such an attack would be recorded forever in Git
> > > 
> > > history.
> > 
> > On the minus side, time-machine makes said record a landmine to
> > step
> > 
> > into.
> 
> I've suggested this before and this seems like a good time to bring
> it up again: can we create a database of known "bad" Guix commit
> hashes, and make time-machine fetch the list and warn before it'll
> visit one of those hashes? This would resolve the land-mine problem
> and generally de-risk our git tree, which is maintained by fallible
> volunteers who will occasionally push tragic commits.
I don't think things would be quite as simple.  A "bad" commit might
still be perfectly fine to fetch certain things from if they're
unaffected by it, plus you're now tasked with the job of keeping the
list of bad commits safe somehow.  In some situations resetting a
branch might work, but obviously not for months old sleeper commits.