Supply chain security question: What happened to the old koekeishiya/* github handle ?

[paolomainardi]

Sorry for this non-technical question, but we live in a world where supply chain attacks happen daily, and handle changes are a bit scary.
I saw that the old handle is redirected here, and from my research it appears to be the same user, but I want to make sure, for me and other users, that the redirect was legitimate and that we can trust the new handle.

Thanks.

[asmvik]

I own the handle on a different 2FA protected account.

[paolomainardi]

Can I ask the reasons behind the transfer on a new handle ?

[asmvik]

The original handle was just something I made back in 2013 before I actually started using the platform and I wanted a variation of my actual name instead.

[asmvik]

I delayed it for a long time because some of my projects became popular many years ago and I didn't want to break references, but I eventually figured as long as I own the original handle and GitHub doesn't fuck up, the redirects are permanent.

[paolomainardi]

Thanks, @asmvik. My advice is to make a public statement on your GitHub profile or in the projects to help other users like me understand that everything is legitimate and that there are no supply chain security risks.

[asmvik]

I don't think it is a big issue as you can look at both the age of the repository, commit history, and age of my account, and it is fairly obvious that it is the real one, but I'll take it into consideration.

[paolomainardi]

I don't think it is a big issue as you can look at both the age of the repository, commit history, and age of my account, and it is fairly obvious that it is the real one, but I'll take it into consideration.

Yes, I have already taken those steps, but given the rise of modern supply chain attacks and the lack of an official statement, I felt it was important to flag this. I believe that a simple note or a brief public announcement could be a less costly and more effective way to address it.

[asmvik]

I understand your point, but that is also exactly what someone attempting a supply chain attack would do to attempt to claim legitimacy, so I don't think such a statement is good enough to add additional trust. It would be like "trust the words in this readme", but I'd always just have to check the above things regardless.

I get that a statement being there would be like a heads up, so I agree on that part, but it does nothing to help establish trust imo.

[paolomainardi]

I agree, but it's better than nothing.