Live data from Hacker News

Linus Torvalds did not commit this

github.com

81–90 of 198 posts

Re: Linus Torvalds did not commit this

#81
You can just use this and not have to overwrite your name/email:

    git commit -m "message" --author=
You can even pass a different commit date with --date=.

It's actually a really useful feature when you're migrating a project from a different SCM system to git.

Re: Linus Torvalds did not commit this

#82

I don't get it, I never really looked at github comments before. Why are these comments so low-quality? Aren't developers who commit to github the only readership?

I had a relatively sane comment (IMO) about whether github should instead consider allowing users to opt-in to "show unsigned commits which claim to be from this address as unknown."

Oddly enough my comment itself was altered to be a mindless obnoxious comment! (does github use git commits to track the comments themselves?)

Re: Linus Torvalds did not commit this

#83
Yeah, this is one of those "feature not a bug" things that's been known for some time. As others have pointed out, sign your commits if this bothers you. It's even possible to get your fellow open source contributors to sign commits to your project, as we do with the Metasploit Framework: https://github.com/rapid7/metasploit-framework/wiki/Landing-...

Re: Linus Torvalds did not commit this

#84

One workaround would be to remove any public email address you commit under from your Github profile. Github uses these email addresses to tie back to your user profile so if you don't want commits pointing at your profile, don't tie email addresses to your profile. Perhaps some mechanism is called for here for approving tying back to your user on new repositories or making any repository not owned by you or your org…

My github profile email is different from my git author email. The latter is even more accessible. Just run git-log on any repository an author has committed to.

Yes but if you remove that git author email from your list of emails on Github, any commits done under that email will no longer link back to your profile.

Re: Linus Torvalds did not commit this

#85

Earlier quoted context omitted.

Your comment basically reads, "I cheated and got away with it, and I'm proud of it too. I'm so awesome! Take that, stupid professor!"

Don't hate the programmer, hate the tools. ;)

Or how about: don't hate the tools; hate the cheaters?

Re: Linus Torvalds did not commit this

#86

git should really make it possible to use openssh/openssl keys for signing - so that I have one key both to push to github and sign my commits. I know that they can be converted from one form to another ... but its really inconvenient, especially on Windows, etc. The GPG key is designed for a email based collaboration flow - that Linus uses. But most of us use Github or Bitbucket's UI to collaborate. Github/Bitbucket…

I bought a YubiKey[0] a while back and was able to get it to do exactly what you're talking about--even on Windows, which I use most often. It wasn't necessarily easy to set up, but it has been working pretty consistently. It would have probably been easier if I had known more than just the basics of GPG.

I have since switched to using my YubiKey and GPG for SSH authentication on pretty much everything, as well as using it to sign my tags in my public git repositories. I don't think I would want to go back to moving keys between devices or setting up unique keys on each device now that I've got my YubiKey set up. Worth the investment, in my opinion.

[0] https://www.yubico.com/products/yubikey-hardware/

Re: Linus Torvalds did not commit this

#88
post #29

I can imagine a scenario where a malicious employee is intentionally injecting malicious code (backdoor, whatever) and wants that commit tied back to someone else (their enemy, boss).

If they have push access, would github log who actually pushed it (i.e. ssh key)?

Yes, Github's authenticated push logs will tell you that. However, Github won't make those public, because they consider user identification private info.

(Or at least they won't provide those push logs to the Apache Software Foundation, which is how I know this.)

Re: Linus Torvalds did not commit this

#89

Earlier quoted context omitted.

I love this. Had a project in college that was supposed to be time limited... based on repository times. Oops. Big mistake prof. We rolled back the times on our repo and laughed maniacally about our free 6 hour extension.

Should professors really be spending their time locking down all the ways students may try to cheat? At Caltech, proctoring exams (for example) is not allowed by institute policy. A student's honor that he didn't cheat is considered good enough.

Why wouldn't you proctor exams? The time spent is small, less than 10 hours a semester, and the proctors can answer student questions or make corrections and clarifications to test questions. That it's a small disincentive to cheat is nice too, though in my experience only the most blatant of cheating would be caught. I say all this as someone who proctors exams.

Re: Linus Torvalds did not commit this

#90

Earlier quoted context omitted.

I love this. Had a project in college that was supposed to be time limited... based on repository times. Oops. Big mistake prof. We rolled back the times on our repo and laughed maniacally about our free 6 hour extension.

Your comment basically reads, "I cheated and got away with it, and I'm proud of it too. I'm so awesome! Take that, stupid professor!"

[deleted]
Post reply on HN