Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

201–210 of 353 posts

Re: Git password authentication is shutting down

#201

Post by TheRealWatson »

vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

I have gladly forgotten the details by now but last time I developed on Windows GCM was the thing that gave me the most headaches. Our Git was on Azure DevOps (whatever that's called now) not github. Due to reasons we could not use SSH instead.

Re: Git password authentication is shutting down

#202

Post by sellyme »

3np wrote: post #182
sellyme wrote: post #155

Earlier quoted context omitted.

> Most people spend years learning the things that are required to understand how git works They don't need to know how git works, they need to know how to use it. Just like I don't need to know the details of an internal combustion engine to drive a car, someone who only does CSS work doesn't need to know how git works to push commits. A simple GUI interface suffices there. The problem is that the official Git GUI i…

There doesn’t exist any official Git GUI. Others already mentioned GitKraken, which I think is the most noob-friendly GUI while offering pretty complete functionality.

> There doesn’t exist any official Git GUI.

There absolutely does. It's called Git GUI. It's right here: https://github.com/git/git/tree/master/git-gui

Re: Git password authentication is shutting down

#203

Post by CamperBob2 »

francislavoie wrote: post #138
qwerty456127 wrote: post #133

Very sad. An unfriendly move needlessly forcing unnecessary complexity. People should be able to decide this for themselves.

That's not how security works. Give users the easy option, and they'll take it. For things to be secure by default, you need to disallow or _heavily_ discourage all potentially insecure options.

Blindly assuming that everybody has the same threat model is also not how security works.

Re: Git password authentication is shutting down

#204

Post by cbcoutinho »

gigel82 wrote: post #55
vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

Are you open to using a tool like direnv to manage env vars on a directory-wide basis? I used to also suffer from the same paranoia, but direnv has allowed me to take back control regarding directory-specific configuration.

You can configure it to set your git user name/email based on your working directory, for example. This is how I keep the separation you mentioned between personal and work on the same machine

Re: Git password authentication is shutting down

#205

Post by bombela »

geofft wrote: post #93
AlexandrB wrote: post #36

Earlier quoted context omitted.

Let's look at the tutorial for caching git credentials, which is referenced in your first link: ( https://docs.github.com/en/get-started/getting-started-with-... ). It walks you through installing a "cask" using "brew". It doesn't mention how to install homebrew but instead directs you to the homebrew homepage which shows the output of a curl command being fed to `bash -c`. Something that's both bad practice and unin…

Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice." You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst... )" than…

Why the downvotes on the parent? It's literally the same thing: running random code from the internet on your computer!

Re: Git password authentication is shutting down

#207

Post by gigel82 »

cbcoutinho wrote: post #204
gigel82 wrote: post #55

Earlier quoted context omitted.

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

Are you open to using a tool like direnv to manage env vars on a directory-wide basis? I used to also suffer from the same paranoia, but direnv has allowed me to take back control regarding directory-specific configuration. You can configure it to set your git user name/email based on your working directory, for example. This is how I keep the separation you mentioned between personal and work on the same machine

Would something like that exist on Windows?

Also, it doesn't seem to solve the problem of multiple accounts; I more or less accepted I need to manually configure user.name and user.email for each clone, but the account is not part of the same config, it looks like it's stored in some other ephemeral place - maybe GCM Core, or some Credential Manager or who knows.

I only realize it was using the wrong account when I try to push and get some unauthorized error; by that point, my commit log is polluted with the wrong account so I need to do some gymnastics where I reset the authentication, manually copy over files or unstage to purge the metadata, etc.

Re: Git password authentication is shutting down

#208

Post by hulitu »

BeefySwain wrote: post #39
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

How about "put your files in this folder then double click this icon (shell script ) ?

Re: Git password authentication is shutting down

#209

Post by u801e »

BeefySwain wrote: post #39
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

> I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs.

The question really should be why do we want to use git for version control when people really want an backup system where they can essentially update files by uploading a new version of the file.

Post reply on HN