Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds did not commit this

github.com

Post reply on HN
Print view View original

31–40 of 198 posts

Re: Linus Torvalds did not commit this

#31

Post by icebraining »

ultramancool wrote: post #12
nailer wrote: post #4

Earlier quoted context omitted.

I guess the real uptake is that commits should really be signed by default (eg, by encouraging signing in the tools & ecosystem).

Really, this only becomes a problem when services like GitHub link the name up, making it look more legitimate than it is. If they enforced authentication as that user before providing the linking it would be better (perhaps allowing approval of the linking if posted by a different user). Currently it's trivial to make it look like any GitHub user is an actual committer to some sort of egregious or controversial proj…

It doesn't seem to link in reverse to the user page; at least, I can't find anything on Linus' page related to this repo.

Re: Linus Torvalds did not commit this

#32

Post by teraflop »

andmarios wrote: post #21

Also you may send email from any address you want if you put it in the “MAIL FROM” SMTP transaction. Thankfully the Linux kernel project accepts only signed commits.

> Thankfully the Linux kernel project accepts only signed commits.

This is false, FWIW.

Re: Linus Torvalds did not commit this

#33

Post by ultramancool »

thedoctor79 wrote: post #25

So it seems the author has identified a real issue here, but I will go meta on this and identify issues with his demonstration. In my organization this would count as a bug report, so I wondered why this issue was not communicated privately to the operators of Github so they can have a chance to fix it before some un-educated person does some damage. Then I realized this issue might affect other git content hosters,…

The problem is that "it's not a bug, it's a feature". Look at the Linux kernel mirror for example. All those commits come from different users around the internet, but when their emails show up, GitHub can link their usernames to their profiles.

What to do about this though... that's a good question. Perhaps just not linking profiles when pushed in this way and/or labeling them "unverified" would be sufficient. GPG signing would be nice, but would likely annoy some users.

Re: Linus Torvalds did not commit this

#34

Post by seba_dos1 »

ionforce wrote: post #23
igorgue wrote: post #20

Earlier quoted context omitted.

That's the problem with all these guys obsessed with clean commit history.

What's wrong with having a clean commit history? I think it's something people take too lightly.

Nothing. Just like there's nothing wrong with not having it clean.

Re: Linus Torvalds did not commit this

#36

Post by ionforce »

seba_dos1 wrote: post #34
ionforce wrote: post #23

Earlier quoted context omitted.

What's wrong with having a clean commit history? I think it's something people take too lightly.

Nothing. Just like there's nothing wrong with not having it clean.

> there's nothing wrong with not having it clean.

Untrue.

Re: Linus Torvalds did not commit this

#38

Post by bluehawk »

jchung wrote: post #27
mmcclure wrote: post #13

Earlier quoted context omitted.

I'm not sure I follow? All of your work is intact and committed as you, it's just done as a single (squashed) commit instead of N commits. The only difficulty that potentially arises (that we've encountered so far) is a lack of granularity for commit messages, which is why we try to keep PRs very small and focused.

I think what johannes1234321 is concerned about is that while you say the work is intact, he can't actually vouch for that because he didn't do it. You did. Which means that he could potentially be blamed (or praised) for something he didn't do in the event that you don't keep his work intact (intentionally or otherwise).

If someone is concerned about getting blamed or praised for his work, he can sign his commits.

Re: Linus Torvalds did not commit this

#39

Post by jordigh »

teraflop wrote: post #32
andmarios wrote: post #21

Also you may send email from any address you want if you put it in the “MAIL FROM” SMTP transaction. Thankfully the Linux kernel project accepts only signed commits.

> Thankfully the Linux kernel project accepts only signed commits. This is false, FWIW.

Well, the signoff line that Linux requires is a legal signature, not a cryptographic one. It is meaningless to us, but it's good enough for lawyers.

Re: Linus Torvalds did not commit this

#40

Post by mmcclure »

jchung wrote: post #27
mmcclure wrote: post #13

Earlier quoted context omitted.

I'm not sure I follow? All of your work is intact and committed as you, it's just done as a single (squashed) commit instead of N commits. The only difficulty that potentially arises (that we've encountered so far) is a lack of granularity for commit messages, which is why we try to keep PRs very small and focused.

I think what johannes1234321 is concerned about is that while you say the work is intact, he can't actually vouch for that because he didn't do it. You did. Which means that he could potentially be blamed (or praised) for something he didn't do in the event that you don't keep his work intact (intentionally or otherwise).

Ah ok, thanks for the clarification. Yes, that is technically a possibility, but to be fair, a big takeaway from this whole thing is that signed commits are the only way to really have guarantees of authorship. If you're knowledgable enough to do that, you probably have a reasonably clean commit history, which we generally don't squash before merging.
Post reply on HN