Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

91–100 of 353 posts

Re: Git password authentication is shutting down

#91

Post by WorldMaker »

funtime wrote: post #60
tcoff91 wrote: post #44

Earlier quoted context omitted.

Does someone who just wants to experiment with a little bit of web-dev really need to have version control right away? Seems a bit out of scope. That seems like a concept that can wait a few months while they actually just explore writing some code first.

or start with svn or something simpler to get the basics of source control.

SVN was the reason most people when I was in college didn't use source control at all. It was painful to install on Windows. There weren't good hosts for it. (CSV at least had bad old SourceForge.) Once you had it installed and had settled on a host computer (and SVN needs a host), configuring your repositories in it was a whole new mess. SVN is definitely not "simpler".

With git you can install and git init anywhere and go you have source control. Moving commits to another machine gets us into the complications way above of learning GitHub and tools for GitHub, but in terms of 0-60 on "start a repository so you can commit changes" it's really hard to beat.

Re: Git password authentication is shutting down

#92

Post by xur17 »

RussianCow wrote: post #70
Wowfunhappy wrote: post #66

Earlier quoted context omitted.

Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…

Presumably, the token is stronger than the passwords most people are using.

Bingo. Not having to deal with the horrible passwords like to use is huge.

Re: Git password authentication is shutting down

#93

Post by geofft »

AlexandrB wrote: post #36
mynameisvlad wrote: post #27

Earlier quoted context omitted.

Is there a reason one of the many git tutorials online wasn't good enough? https://docs.github.com/en/get-started/quickstart/set-up-git https://www.atlassian.com/git/tutorials This one's always fun: https://learngitbranching.js.org/ https://www.tutorialspoint.com/git/index.htm

Let's look at the tutorial for caching git credentials, which is referenced in your first link: ( https://docs.github.com/en/get-started/getting-started-with-... ). It walks you through installing a "cask" using "brew". It doesn't mention how to install homebrew but instead directs you to the homebrew homepage which shows the output of a curl command being fed to `bash -c`. Something that's both bad practice and unin…

Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice."

You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst...)" than burning https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/de... and booting it up.

Re: Git password authentication is shutting down

#94

Post by pbhjpbhj »

BeefySwain wrote: post #39
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

Edit: user post-it already said this, sorry.

I'm not experienced here, but is using the GitHub website perhaps the easiest way to submit a PR, that's how I first did it and I think it worked ... I've only really used git privately and for pulling code from public projects.

Re: Git password authentication is shutting down

#95

Post by hiimshort »

tcoff91 wrote: post #44
hiimshort wrote: post #32

Earlier quoted context omitted.

In this case it is a younger college student who's interested in web development but hasn't done any CS learning and isn't generally familiar with tech.

Does someone who just wants to experiment with a little bit of web-dev really need to have version control right away? Seems a bit out of scope. That seems like a concept that can wait a few months while they actually just explore writing some code first.

> Does someone who just wants to experiment with a little bit of web-dev really need to have version control right away?

To explain: She wants to eventually work as a developer and has a project in mind guiding her. I started her with the simplest possible steps and she's been learning html & css for a few weeks now with some great progress. She got the the point where she was starting to have multiple projects she was building for learning. In addition, she was starting to feel the pain of "this project is on my desktop, but I am going to be away from home for a week and will only have my laptop." For those reasons (as well as the benefit of introducing GitHub as a place of collaboration), we took some a few hours to cover git and the terminal.

It didn't seem like we jumped to it too early and after those three hours she had the basics which is good enough to ensure her projects are safely replicated to GitHub and available for her no matter which machine she is on.

Re: Git password authentication is shutting down

#96

Post by peterburkimsher »

narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

Thank you for being humble and describing the ways you use GitHub!

I'm the same, and it's reassuring to know that I'm not the only one just using it as a free web host for personal projects.

Until starting a new job in January 2021, I "knew git" to the extent of git pull, git add, git commit -m, and git push. For everything else I just made a copy of the repo. Now I've learned a little more about branches and merge requests, but I still make a copy of the repo and copy my changes over when things go wrong. https://xkcd.com/1597/

Like you, I got some password-related warnings on GitHub, and honestly it's scaring me away. I know it'll take an hour or so to figure out what went wrong, regenerate a ton of SSH keys for every computer I own and link them to my account, disable 2FA because my phone number is in another country... I'd rather just upload a file, thanks.

The increased overhead means I'd rather just use FTP to upload some files to an HTTP server, but I don't think that such free FTP web hosts exist any more. At least, not ones with a domain that people recognise. That said, peterburk.github.com is no longer accessible, only peterburk.github.io, so maybe it is time for me to go looking for a free .com subdomain.

I'm grateful for GitHub hosting all the junk I decide to share, and I'm obviously not their target market if I'm not paying. I just wish there were a place I could drag & drop to upload content publicly.

Re: Git password authentication is shutting down

#97

Post by WorldMaker »

the8472 wrote: post #65
post-it wrote: post #53

Earlier quoted context omitted.

> Think, having your graphics designer able to make commits, or having someone who only wants to update docs. GitHub's web interface is pretty good for this.

Until you need them to rewrite history because it consists of 20 "fix" and "update" commits.

Then don't need them to rewrite history? That's kind of on you and your own OCD at that point. If you are making them use a PR workflow anyway, become friends with git options like using --first-parent to shallowly traverse the DAG and let git's tools give you a clean view. (Or use GitHub's PR Squash options, if you really must rewrite history.)

Re: Git password authentication is shutting down

#98

Post by OJFord »

the8472 wrote: post #65
post-it wrote: post #53

Earlier quoted context omitted.

> Think, having your graphics designer able to make commits, or having someone who only wants to update docs. GitHub's web interface is pretty good for this.

Until you need them to rewrite history because it consists of 20 "fix" and "update" commits.

Someone that does that isn't going to meaningfully rewrite the history anyway, just squash on merge.

Re: Git password authentication is shutting down

#99

Post by benatkin »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

It won't always add more confusion. Some non-developers are familiar with security. For them, they might be glad to see they aren't typing their password into a program, just like they know they shouldn't be entering their password to get twitter stats.

Re: Git password authentication is shutting down

#100

Post by cstrat »

pjc50 wrote: post #48
BeefySwain wrote: post #39

Earlier quoted context omitted.

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

The solution that everyone actually uses until they learn the unnecessary details is "take a backup of relevant files and blow away & redownload the repo".

wait there is another way?
Post reply on HN