Seems odd Github would announce the cutoff time in PST when the USA is in PDT.
This is a very common mistake. Lots of people are unaware that they're supposed to change acronyms depending on whether or not daylight savings time is in effect.
Git password authentication is shutting down
111–120 of 353 posts
Re: Git password authentication is shutting down
#112I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…
I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…
This is painfully accurate at every step you outlined.
Re: Git password authentication is shutting down
#113Earlier quoted context omitted.
Just so folks know, you can still use personal access tokens, which basically work as per-application passwords. For someone just getting started with git, I'd recommend they go to https://github.com/settings/tokens , generate a token, and then they can just use that as their password when running `git clone`. This will certainly be a little more difficult for newcomers, and not very discoverable, but it is there.
Right, but this is also what makes me skeptical of the whole thing. I now have a Personal Access Token saved in my password manager. When I’m in a disposable VM, and git asks for a password (because it’s a fresh, disposable VM), I copy the personal access token out of my password manager, instead of copying my Github password out of my password manager. Okay, no big deal, I just have to spend an extra second searchin…
Access tokens can practice least privilege and be scoped to a limited set of actions on a single repo. Your user password has whatever privileges your user has on every repo you've been given access to.
Re: Git password authentication is shutting down
#114Earlier quoted context omitted.
Key based auth is much more resistant to phishing. Its just one command to have openssh generate a key pair on your computer, and you're done. Password auth in general cannot go away fast enough.
Not in Windows unless you have WOL installed.
I'm using Windows and git with ssh keys and haven't managed to install WOL.
What you need is to install Git for Windows. It will include ssh-keygen (if it's not already there) and you can do the usual dance.
Re: Git password authentication is shutting down
#115When will we get repo-specific tokens? That's what I really want. As-is, I've just created extra special purpose github accounts, but that's a bad solution IMO.
You mean like deploy keys? https://docs.github.com/en/developers/overview/managing-depl...
Can you use deploy keys to auth with the api?
Re: Git password authentication is shutting down
#116I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…
GitHub Desktop, since being rewritten whenever the last time was, is pretty decent and I just have people install that to initially clone the project and set up the remotes and then they can still use the command line or IDE to make commits and pushes if they want.
Re: Git password authentication is shutting down
#117Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…
I was in the same boat until recently. There have even been a couple of projects I got invited to that I never could join because of this (since multi-factor doesn't work with terminal username/password).
I've tried setting up SSH keys many times and have somehow failed many times. The UX for security stuff just isn't there. I finally have gotten a workflow sort-of figured out and documented to remind myself in the future.
Re: Git password authentication is shutting down
#118Earlier quoted context omitted.
The solution that everyone actually uses until they learn the unnecessary details is "take a backup of relevant files and blow away & redownload the repo".
wait there is another way?
I've used GitExtensions from the start of my Git usage. I've never had to blow any of my repos away at any point. I also use things like Rebase without thinking about it, something which from what I've read on here is considered a slightly unusual/difficult task.
Using GitExtensions means I can use Git as easily as any other tool, I never give it a second thought. I see the command line commands being executed, but never think about them. The flipside is I'd be knackered if I had to use the command line only.
Re: Git password authentication is shutting down
#119Earlier quoted context omitted.
I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…
> Think, having your graphics designer able to make commits, or having someone who only wants to update docs. GitHub's web interface is pretty good for this.
Not really. People say stuff like this, but what they're really talking about is their own familiarity with GitHub (in the vein of http://lighttable.com/2014/05/16/pain-we-forgot/>).
What GitHub has going for it is that it is familiar to ("a majority of"?) working developers, and that it's better than both the competition and the Git CLI itself, but from a reality-adjusted perspective, GitHub is pretty bad, too. (Then when people like me make comments like this, others wrongly infer that it comes from a history of false starts and firsthand frustration, unable to conceive that anyone would speak up on this sort of thing if there weren't something personal at stake; no way that it could just be the result of empathy for the uninitiated.)
It's pretty tragic that we've basically killed wikis —like, actual wikis—and regressed back to directories of text files managed by version control systems originally meant for handling program source code. That people then go on to call these wikis is basically an insult to history.
52028d35999a481e7cb19b14eae3bf66cb7c9c4fe2e15b56b55f3ccadffeee1f
Re: Git password authentication is shutting down
#120tldr Git SSH protocol will still support authentication via username:password but in this case, the "password" can no longer be your Github Account password, but it can be a Personal Access Token. So no need to panic if you've been using a build system or other tool that authenticates with username:token instead of a SSH key.
it’s really just swapping one password for another. I don’t even care if someone got access to my github account, access to the repos is bad enough.