It's pretty much the same as forging email. Most won't notice. Both can be signed with pgp, but few check and it's clumsy for the mainstream.
Linus Torvalds did not commit this
91–100 of 198 posts
Re: Linus Torvalds did not commit this
#92It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.
It is a Git issue. In any Git repo, you can spoof anybody's name or email. All Github did here is show his Github account instead of e-mail. That doesn't really make it worse.
It being a "Git issue" implies it should be fixed by modifying the Git software. I'm not entirely sure how someone would go about doing that, assuming you can't assume that each machine generating contributions will only be used by a single contributor and never shared. (Tokens such as thumb drives can be stolen and copied, too, and an application can't be sure it's reading off a thumb drive anyway.)
Re: Linus Torvalds did not commit this
#93Linus actually commented on this lack of identity handling in 2012 in his famous explanation of why he doesn't use GitHub: https://github.com/torvalds/linux/pull/17
"since github identities are random, I expect the pull request to be a signed tag, so that I can verify the identity of the person in question."
And:
"github throws away all the relevant information, like having even a valid email address for the person asking me to pull."
Re: Linus Torvalds did not commit this
#94Earlier quoted context omitted.
Nothing. Just like there's nothing wrong with not having it clean.
Depends on the project. If I ran the Linux kernel, I'd insist on clear commits too.
Oh no no no. If you are handling something as important as the Linux kernel, you will absolutely want traceability over anything as trivial as clean history. You will impose signed commits and signed merges only... none of these FF stuff.
If you want clean history on top of that, you will enforce that on original pull request not after the fact.
Re: Linus Torvalds did not commit this
#95Yeah this is known, and you can get yourself an awesome list of contributors if you want: https://github.com/zixan/uberfareestimator/graphs/contributo... I think github should allow me as a user to confirm contributions made out of the system, at least the first time per repo.
I second that too.
Re: Linus Torvalds did not commit this
#96Earlier quoted context omitted.
Should professors really be spending their time locking down all the ways students may try to cheat? At Caltech, proctoring exams (for example) is not allowed by institute policy. A student's honor that he didn't cheat is considered good enough.
Why wouldn't you proctor exams? The time spent is small, less than 10 hours a semester, and the proctors can answer student questions or make corrections and clarifications to test questions. That it's a small disincentive to cheat is nice too, though in my experience only the most blatant of cheating would be caught. I say all this as someone who proctors exams.
The reason was to emphasize that the students were trusted. Sometimes a professor would sit outside in the hall to answer questions, but he would not go in the room.
Most of the exams were take-home anyway, and included instructions giving a time limit and what reference material was allowed to be used.
Re: Linus Torvalds did not commit this
#97Earlier quoted context omitted.
I guess the real uptake is that commits should really be signed by default (eg, by encouraging signing in the tools & ecosystem).
Really, this only becomes a problem when services like GitHub link the name up, making it look more legitimate than it is. If they enforced authentication as that user before providing the linking it would be better (perhaps allowing approval of the linking if posted by a different user). Currently it's trivial to make it look like any GitHub user is an actual committer to some sort of egregious or controversial proj…
I disagree, the real problem here is people thinking that somehow any github repository can be a trusted source. If you work on Linux, you know that the one and only source of truth is the repo that comes from Linus himself, not anything coming from github.
Re: Linus Torvalds did not commit this
#98There is a huge UX problem with validating the legitimacy of anything online. I have to know that credentials are available, and I have to know that it's possible to validate them. How do I even know if a particular set of credentials are legit? I'd have to know where to find validation for them. That's a whole other ball of wax in itself. And we default to not requiring such authentication because the means we have…
Any information you can get online or over the phone can be forged. (Passwords can be discovered, as can private keys, fingerprints, and the results of genetic tests.) Certain kinds of physical evidence, such as dead skin cells with usable genetic material in them, are to my knowledge effectively impossible to forge, but they can be "accidentally" contaminated beyond usability. Doing things in-person face-to-face is only an improvement if you knew the person before anyone had any incentive to fool you on the person's identity, which is hard; even then, allegiances can be bought, sold, and changed for other reasons.
My point is that fixing this issue is out-of-scope for a DVCS. It could, however, be improved a bit.
Re: Linus Torvalds did not commit this
#99TBH we "exploit" this when accepting PRs for an open source project I work on. It's not really feasible for us to expect / force each PR author to have a clean commit history, so we basically do some squashing, then commit the "single" change as the original author before merging.
You’re doing a rebase, which is not the same thing as purposely editing the commit author credentials.
Re: Linus Torvalds did not commit this
#100Earlier quoted context omitted.
That's the problem with all these guys obsessed with clean commit history.
What's wrong with having a clean commit history? I think it's something people take too lightly.
Well, as this submission demonstrates... you lose integrity and accountability
(which you never had in the first place, if you don't sign your commits)