My assumption is that each user would be an Object in ActivityPub and then you would follow that user (subscribe in Lemmy terms). If that's the case, then that user would appear to be a community in your feed.
loakang
joined 1 year ago
I'd like to see how Threads evolves before preemptively deciding to cease interacting with it. However, if it's anything like Facebook or Instagram today then please keep it away from me
Unless they have access to your private key then there's no way they can sign code as you.
Alternatively yes, access to your password (and 2fa) would allow them the ability to add an ssh private key for you.
But that's irrelevant because the issue at hand is that I can make a commit to a repo that I have access to, but using your username, and there's no way to verify it wasn't you (actually there is but it requires some assumptions and is also dependent on the git hosting infrastructure)
However when you use signing, key 'A' may be able to access a repo but can't sign commits as key 'B', so you can't have the blame dropped on you for malicious commits (again, unless they also compromised your account/key)