呵呵，下面还给了个链接
https://news.ycombinator.com/item?id=24976138
slimsag on Nov 3, 2020 | parent | context | favorite | on: How to publish Git repos that cannot be republishe...
Others probably have not fully realized this yet, but with GitHub one can:
1) Publish arbitrary commits under your
https://github.com/my/project URL, e.g. a fake
https://github.com/my/project/blob/<faked_commit>/README.md in your project describing how to install it that actually describes installing malware.
2) Publish those commits under your name, with your email address, and GitHub will prominently display it as if you made the commit (most do not use GPG signatures, and most do not know to look for "Verified" anyway)
It seemed only a matter of time before this behavior got abused for something (anti-DMCA action is perhaps the best outcome of this situation I can imagine..)
【 在 hgoldfish 的大作中提到: 】
:
https://github.com/torvalds/linux/tree/8bcab0346d4fcf21b97046eb44db8cf37ddd6da0: 听说是 github 的 bug.
:
--
FROM 110.185.26.*