I can imagine a scenario where a malicious employee is intentionally injecting malicious code (backdoor, whatever) and wants that commit tied back to someone else (their enemy, boss).
Linus Torvalds did not commit this
11–20 of 198 posts
Re: Linus Torvalds did not commit this
#12Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables. I guess it's worth noting here that you can sign your commits with GPG: https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work
I guess the real uptake is that commits should really be signed by default (eg, by encouraging signing in the tools & ecosystem).
Really, this only becomes a problem when services like GitHub link the name up, making it look more legitimate than it is. If they enforced authentication as that user before providing the linking it would be better (perhaps allowing approval of the linking if posted by a different user). Currently it's trivial to make it look like any GitHub user is an actual committer to some sort of egregious or controversial project and users unaware of how GitHub maps this may easily be confused.
EDIT: This gets even more disturbing when you realize that GitHub is a site many people list on their resumes and if this association applies from their user page too this could get very bad.
Re: Linus Torvalds did not commit this
#13TBH we "exploit" this when accepting PRs for an open source project I work on. It's not really feasible for us to expect / force each PR author to have a clean commit history, so we basically do some squashing, then commit the "single" change as the original author before merging.
So, when submitting to your project it can happen that I'm afterwards blamed for things I didn't do? (Or praised)
I'm not sure I follow? All of your work is intact and committed as you, it's just done as a single (squashed) commit instead of N commits. The only difficulty that potentially arises (that we've encountered so far) is a lack of granularity for commit messages, which is why we try to keep PRs very small and focused.
Re: Linus Torvalds did not commit this
#14In other words, a lot of people haven't the slightest clue how Git works. Luckily Github record push history separately
Re: Linus Torvalds did not commit this
#15Another good article on git-signing: http://mikegerwitz.com/papers/git-horror-story
Re: Linus Torvalds did not commit this
#16It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.
Re: Linus Torvalds did not commit this
#17Yeah this is known, and you can get yourself an awesome list of contributors if you want: https://github.com/zixan/uberfareestimator/graphs/contributo...
I think github should allow me as a user to confirm contributions made out of the system, at least the first time per repo.
Re: Linus Torvalds did not commit this
#18we even do not know if he REALLY did not commit this ;)
Re: Linus Torvalds did not commit this
#19Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables. I guess it's worth noting here that you can sign your commits with GPG: https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work
Similarly, nothing stops you altering the time claimed in the commit. Or -- for that matter -- from taking someone's diff and claiming credit for it.
For that reason, I jokingly created `git-upstage`, which streamlines the process of abusing commit edits and plagiarizing code! It squashes a branch, backdates it 5 minutes, and claims you wrote it.
https://github.com/SilasX/git-upstage
Edit: Looks like my last commit left the important stuff commented out and can't fix it at the moment. Ah well, you're going to use the tool to rip it off anyway ;-)
Re: Linus Torvalds did not commit this
#20TBH we "exploit" this when accepting PRs for an open source project I work on. It's not really feasible for us to expect / force each PR author to have a clean commit history, so we basically do some squashing, then commit the "single" change as the original author before merging.
So, when submitting to your project it can happen that I'm afterwards blamed for things I didn't do? (Or praised)
That's the problem with all these guys obsessed with clean commit history.