Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds did not commit this

github.com

Post reply on HN
Print view View original

111–120 of 198 posts

Re: Linus Torvalds did not commit this

#111

Post by berdario »

rabbyte wrote: post #9
wcummings wrote: post #3

I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.

While it's probably well known from a command line perspective, I doubt it's well known from a web service (GitHub) perspective. I have a healthy distrust of git logs but trusting a photo and username on GitHub is a pattern reinforced by every other social app.

Not only it's not well known, but it breaks them:

some years ago I reported this issue on gitorious, which yielded an HTTP500 when the repository contained a signed commit:

https://issues.gitorious.org/issues/193 (it's now down, but hopefully it'll reappear on archive.org)

and it'll prevent Launchpad from automatically mirroring git repositories (which is paramount to be able to automatically update PPA with recipes)

https://bugs.launchpad.net/bzr-git/+bug/1372149

Re: Linus Torvalds did not commit this

#112

Post by uniformlyrandom »

SilasX wrote: post #19
seba_dos1 wrote: post #2

Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables. I guess it's worth noting here that you can sign your commits with GPG: https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work

Similarly, nothing stops you altering the time claimed in the commit. Or -- for that matter -- from taking someone's diff and claiming credit for it. For that reason, I jokingly created `git-upstage`, which streamlines the process of abusing commit edits and plagiarizing code! It squashes a branch, backdates it 5 minutes, and claims you wrote it. https://github.com/SilasX/git-upstage Edit: Looks like my last commit l…

Oh, it appears that git 2.3.2 only allows to go back as far as Dec 2014.

That is a pity. I have already prepared a README.md claiming that I have created the internet, but then I failed while trying to backdate it to 1969 (PDT). I was this close to becoming very rich and very evil. Oh well.

Re: Linus Torvalds did not commit this

#114

Post by seba_dos1 »

uniformlyrandom wrote: post #112
SilasX wrote: post #19

Earlier quoted context omitted.

Similarly, nothing stops you altering the time claimed in the commit. Or -- for that matter -- from taking someone's diff and claiming credit for it. For that reason, I jokingly created `git-upstage`, which streamlines the process of abusing commit edits and plagiarizing code! It squashes a branch, backdates it 5 minutes, and claims you wrote it. https://github.com/SilasX/git-upstage Edit: Looks like my last commit l…

Oh, it appears that git 2.3.2 only allows to go back as far as Dec 2014. That is a pity. I have already prepared a README.md claiming that I have created the internet, but then I failed while trying to backdate it to 1969 (PDT). I was this close to becoming very rich and very evil. Oh well.

Don't give up so easily - you have the source code! ;)

Re: Linus Torvalds did not commit this

#115

Post by [deleted] »

philh wrote: post #110
[deleted] wrote: post #90

Earlier quoted context omitted.

[deleted]

Finding the exploit and taking advantage of it are different. "I discovered that if you rip the tags out of a library book, you can just walk out with it and the alarm won't go off!" For some people, that would be a significant "a-ha!" moment. That doesn't mean they should go around stealing library books.

[deleted]

Re: Linus Torvalds did not commit this

#116

Post by igorgue »

bronson wrote: post #57
seba_dos1 wrote: post #34

Earlier quoted context omitted.

Nothing. Just like there's nothing wrong with not having it clean.

Depends on the project. If I ran the Linux kernel, I'd insist on clear commits too.

You need that level of traceability on each commit specially on the Linux kernel, all our little projects sure, destroy the history, is fine.

Re: Linus Torvalds did not commit this

#117

Post by WalterBright »

ectoplasm wrote: post #107
WalterBright wrote: post #96

Earlier quoted context omitted.

The reason was to emphasize that the students were trusted. Sometimes a professor would sit outside in the hall to answer questions, but he would not go in the room. Most of the exams were take-home anyway, and included instructions giving a time limit and what reference material was allowed to be used.

To me this sounds like admin trying to save money. I found some more discussion in a couple places: http://blog.sethroberts.net/2014/02/17/cheating-at-caltech/ https://www.quora.com/Are-all-exams-at-Caltech-take-home-exa...

That's the first I've heard that it had anything to do with saving money, and I spent 4 years there. It does, however, make life easier for professors and students when you can trust each other.

I don't know what Caltech is like today. I attended in 70's, and the honor system was considered sacred by the students. If there were cheaters, they never bragged about it, and I don't know of any. I know one who fell asleep during his takehome exam, woke up and finished it, and so exceeded the time limit. He noted this on the exam. The professor replied back that he was very sorry and was forced to give him an F. The student repeated the (required) class next year.

The number of students who did poorly on exams argues that cheating was not widespread.

If the culture has changed in the intervening years, that makes me very sad.

Re: Linus Torvalds did not commit this

#118

Post by jayhuang »

This has been around for quite a while now; I made a post on my blog about it back in 2013: http://www.jayhuang.org/blog/pushing-code-to-github-as-linus...

Of course this doesn't actually give you access to the person's account, but UX wise, it's incredibly misleading for someone to click a commit in my repository by "torvalds" and have it actually go to his profile. My issue is very much with the social implications of this as opposed to it being an actual security issue (see: signed commits).

There should be some indication at the very least that a commit is not signed.

Re: Linus Torvalds did not commit this

#119

Post by mmcclure »

hk__2 wrote: post #99
mmcclure wrote: post #6

TBH we "exploit" this when accepting PRs for an open source project I work on. It's not really feasible for us to expect / force each PR author to have a clean commit history, so we basically do some squashing, then commit the "single" change as the original author before merging.

You’re doing a rebase, which is not the same thing as purposely editing the commit author credentials.

Negative, we're actually editing the commit author credentials when we create the final commit message, which adds a Changelog message and closes the original PR.

https://github.com/videojs/video.js/blob/master/contrib.json...

Re: Linus Torvalds did not commit this

#120

Post by [deleted] »

WalterBright wrote: post #117
ectoplasm wrote: post #107

Earlier quoted context omitted.

To me this sounds like admin trying to save money. I found some more discussion in a couple places: http://blog.sethroberts.net/2014/02/17/cheating-at-caltech/ https://www.quora.com/Are-all-exams-at-Caltech-take-home-exa...

That's the first I've heard that it had anything to do with saving money, and I spent 4 years there. It does, however, make life easier for professors and students when you can trust each other. I don't know what Caltech is like today. I attended in 70's, and the honor system was considered sacred by the students. If there were cheaters, they never bragged about it, and I don't know of any. I know one who fell asleep…

[deleted]
Post reply on HN