Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds did not commit this

github.com

Post reply on HN
Print view View original

61–70 of 198 posts

Re: Linus Torvalds did not commit this

#61

Post by andrewstuart2 »

yxhuvud wrote: post #53
aikah wrote: post #16

It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.

It is really not possible for github to track the origin of commits. For example, consider a fork. If you pull some commits from the original and then push them to your fork then that would look just like this. The only thing I can think of is that it may be possible to track commits if everyone would sign them as they were created, but that would require all users to change, so I don't see how that can happen.

If a user could upload their public GPG key to their account (as they can their public SSH key), GitHub could easily verify signed commits, which git itself allows with `git commit --gpg-sign[=] ...`.

It would be trivial for them to shell out to `git verify-commit ` in order to verify that the claimed originator has signed his commits with a key tracked by github (by email address, which can belong to only one github user).

Re: Linus Torvalds did not commit this

#63

Post by arihant »

aikah wrote: post #16

It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.

It is a Git issue. In any Git repo, you can spoof anybody's name or email. All Github did here is show his Github account instead of e-mail. That doesn't really make it worse.

Re: Linus Torvalds did not commit this

#64

Post by jerf »

yxhuvud wrote: post #53
aikah wrote: post #16

It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.

It is really not possible for github to track the origin of commits. For example, consider a fork. If you pull some commits from the original and then push them to your fork then that would look just like this. The only thing I can think of is that it may be possible to track commits if everyone would sign them as they were created, but that would require all users to change, so I don't see how that can happen.

A checkbox that requires push commits to be signed (you don't have to sign each one, but the top level of any push would have to be signed) would be nice. So would any indication that commits are signed in the GitHub UI. I've started signing my commits to GitHub, but verifying even that a signature is present (let alone correct) requires you to clone the repo and investigate it with commands you'd probably have to Google, as far as I know. No UI visibility whatsoever.

Re: Linus Torvalds did not commit this

#67

Post by [deleted] »

bluehawk wrote: post #38
jchung wrote: post #27

Earlier quoted context omitted.

I think what johannes1234321 is concerned about is that while you say the work is intact, he can't actually vouch for that because he didn't do it. You did. Which means that he could potentially be blamed (or praised) for something he didn't do in the event that you don't keep his work intact (intentionally or otherwise).

If someone is concerned about getting blamed or praised for his work, he can sign his commits.

[deleted]

Re: Linus Torvalds did not commit this

#68

Post by micampe »

seba_dos1 wrote: post #2

Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables. I guess it's worth noting here that you can sign your commits with GPG: https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work

Signing my commits doesn’t prove that I didn’t do an unsigned one.

Re: Linus Torvalds did not commit this

#69

Post by andrewstuart2 »

rabbyte wrote: post #9
wcummings wrote: post #3

I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.

While it's probably well known from a command line perspective, I doubt it's well known from a web service (GitHub) perspective. I have a healthy distrust of git logs but trusting a photo and username on GitHub is a pattern reinforced by every other social app.

It does give a strong impression of authority that said user did indeed author a commit. Especially being a link to that user's profile.

Re: Linus Torvalds did not commit this

#70

Post by sytse »

seba_dos1 wrote: post #2

Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables. I guess it's worth noting here that you can sign your commits with GPG: https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work

We would love support for signed commits in GitLab itself so you can check the signature from the web-interface http://feedback.gitlab.com/forums/176466-general/suggestions...
Post reply on HN