41–50 of 198 posts
TBH we "exploit" this when accepting PRs for an open source project I work on. It's not really feasible for us to expect / force each PR author to have a clean commit history, so we basically do some squashing, then commit the "single" change as the original author before merging.
Earlier quoted context omitted.
I guess the real uptake is that commits should really be signed by default (eg, by encouraging signing in the tools & ecosystem).
Really, this only becomes a problem when services like GitHub link the name up, making it look more legitimate than it is. If they enforced authentication as that user before providing the linking it would be better (perhaps allowing approval of the linking if posted by a different user). Currently it's trivial to make it look like any GitHub user is an actual committer to some sort of egregious or controversial proj…
One workaround would be to remove any public email address you commit under from your Github profile. Github uses these email addresses to tie back to your user profile so if you don't want commits pointing at your profile, don't tie email addresses to your profile. Perhaps some mechanism is called for here for approving tying back to your user on new repositories or making any repository not owned by you or your org…
In other words, a lot of people haven't the slightest clue how Git works. Luckily Github record push history separately
In Git, it's clear that there's no authentication, a user is just a tuple of strings, but on Github the same doesn't apply, a user is actually a well defined entity which is secured by one or even two factors of authentication, so the expectations are different.
Also you may send email from any address you want if you put it in the “MAIL FROM” SMTP transaction. Thankfully the Linux kernel project accepts only signed commits.
> Thankfully the Linux kernel project accepts only signed commits. This is false, FWIW.
Earlier quoted context omitted.
Similarly, nothing stops you altering the time claimed in the commit. Or -- for that matter -- from taking someone's diff and claiming credit for it. For that reason, I jokingly created `git-upstage`, which streamlines the process of abusing commit edits and plagiarizing code! It squashes a branch, backdates it 5 minutes, and claims you wrote it. https://github.com/SilasX/git-upstage Edit: Looks like my last commit l…
I love this. Had a project in college that was supposed to be time limited... based on repository times. Oops. Big mistake prof. We rolled back the times on our repo and laughed maniacally about our free 6 hour extension.
If you know it, everything about email and its protocols would make you assume the exact opposite.
Now PGP signatures on the other hand … but hey, nobody wants those, right?! Far too complicated! /rant
Interesting, there must be some level of validation because it does not show up in his public activity feed[0] [0] https://github.com/torvalds?tab=activity
The GPG key is designed for a email based collaboration flow - that Linus uses. But most of us use Github or Bitbucket's UI to collaborate.
Github/Bitbucket should use this key in their UI as well - to show verified users.