←back to thread

Immutable releases are now generally available on GitHub

(github.blog)
151 points fastest963 | 1 comments | 31 Oct 25 13:59 UTC | HN request time: 0s | source
Show context
eviks ◴[31 Oct 25 15:10 UTC] No.45772876[source]▶
Why is deletion not allowed, which supply chain attacks work by deleting a release, not changing it to a malicious one?
replies(5): >>45773196 #>>45773264 #>>45773401 #>>45773560 #>>45773758 #
darkamaul ◴[31 Oct 25 15:47 UTC] No.45773401[source]▶
I think the reason here is to prevent deletion that cause upstream disruptions.

See the reasoning in the PEP 763 (not adopted )

https://peps.python.org/pep-0763/

replies(1): >>45773699 #
1. eviks ◴[31 Oct 25 16:11 UTC] No.45773699[source]▶
Strange they haven't identified negative security implications: if the owner notices the hack he can delete the malicious release before the central authority, so this would limit the blast radius (think there was a recent such issue with npm where there was a delay between discovery (by the author) and removal)

Otherwise yes, leftpad/coverup risk is a thing