Git password authentication is shutting down • Hacker News Board

Re: Git password authentication is shutting down

#211

Post by ducktective » Fri, Aug 13, 2021, 5:55 AM UTC

BeefySwain wrote: post #39

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

I can vouch for this TUI interface for git: https://github.com/jesseduffield/lazygit

Re: Git password authentication is shutting down

#212

Post by Jipazgqmnm » Fri, Aug 13, 2021, 6:13 AM UTC

BeefySwain wrote: post #39

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

You might refer them to the manual: https://git-man-page-generator.lokaltog.net/#cGVyZm9ybSQkd29...

Re: Git password authentication is shutting down

#213

Post by nine_k » Fri, Aug 13, 2021, 6:15 AM UTC

narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

> it's public, after all, so i had the expectation that all info on there is insecure

I think it's a misconception.

Unless you just let everyone write anything in your repo, one would expect that what is there is what it says on the tin.

Every public software project takes measures to stay authentic and not let random and unreviewed, potentially malicious bits in. This is how they keep their users' trust.

Very roughly, "public" = read access is unrestricted, and "insecure" = write access is unrestricted.

Re: Git password authentication is shutting down

#214

Post by milofeynman » Fri, Aug 13, 2021, 6:25 AM UTC

morpheuskafka wrote: post #116

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

GitHub Desktop, since being rewritten whenever the last time was, is pretty decent and I just have people install that to initially clone the project and set up the remotes and then they can still use the command line or IDE to make commits and pushes if they want.

I'm starting to forget normal git workflow because GitHub for windows is so damn good. It's a great user experience and they've even added some great features recently like rebasing into dev.

Re: Git password authentication is shutting down

#215

Post by 3np » Fri, Aug 13, 2021, 6:26 AM UTC

sellyme wrote: post #202

3np wrote: post #182

Earlier quoted context omitted.

There doesn’t exist any official Git GUI. Others already mentioned GitKraken, which I think is the most noob-friendly GUI while offering pretty complete functionality.

> There doesn’t exist any official Git GUI. There absolutely does. It's called Git GUI. It's right here: https://github.com/git/git/tree/master/git-gui

I'm a doofus, thanks for correcting.

Re: Git password authentication is shutting down

#216

Post by 0x0 » Fri, Aug 13, 2021, 6:27 AM UTC

vtbassmatt wrote: post #171

gigel82 wrote: post #55

Earlier quoted context omitted.

GCM still doesn't support multiple users properly, though. Https auth is what I was using for a second GitHub account, so I'm not thrilled about this change. I want to have work and personal GitHub accounts on the same machine and very explicitly choose which account goes to which repo. Too often I have changes going in with the wrong user.name / user.email or account to the point where I paranoidly reauthenticate ev…

We recently added support for multiple identities but it's not complete (or seemingly documented, oops). I'll take a note to look into fixing and extending it. Edit: but also, GCM Core has nothing to do with the user.email/user.name in .gitconfig. I have a similar problem where I want some commits written with my work email and others with my personal, and I always forget to check it when starting in a new repo. I pu…

You can use includeIf in your gitconfig to set different email defaults based on directory prefix. So keep your personal projects grouped in a personal directory and you don't have to do anything special for each project

Re: Git password authentication is shutting down

#217

Post by happymellon » Fri, Aug 13, 2021, 6:33 AM UTC

francislavoie wrote: post #136

northwest65 wrote: post #118

Earlier quoted context omitted.

I've used GitExtensions from the start of my Git usage. I've never had to blow any of my repos away at any point. I also use things like Rebase without thinking about it, something which from what I've read on here is considered a slightly unusual/difficult task. Using GitExtensions means I can use Git as easily as any other tool, I never give it a second thought. I see the command line commands being executed, but n…

I used GitExtension for years, but then I switched to Linux some years ago, so I had to find an alternative. I used SourceTree for a while, but I hated the UX. I tried GitKraken when it first came out, but it had a lot of issues that didn't make it appropriate for my workflow. After a couple more years, GitKraken had improved enough that I was able to switch to it. I've been using it for maybe 4 or 5 years now.

The pricing of GitKraken is a little frustrating. 5 pounds a month is quite a hefty price just to be able to use a private repo. Especially since it has not materially changed for my usage, so I would have been much happier giving them the £50 for a single licence.

This is once of those scenarios where subscription for an enterprise might be a thing, but makes no sense for me. The JetBrains model would make sense and I could justify that.

Re: Git password authentication is shutting down

#218

Post by raxxorrax » Fri, Aug 13, 2021, 6:35 AM UTC

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

I think shutting down password auth is a mistake, especially if you look at MS services and where they stand now. Authenticating against their Graph API is such a hassle that we just skipped its inclusion in some of our projects because we just don't have the dev time available for allocation.

While it is fine to require better auth, it should be in the hands of users. Otherwise adoption is severely endangered.

That said, Github is an extremely juicy target for someone trying to inject code in a lot of codebases without anyone noticing. So popular repos should certainly make use of it.

Re: Git password authentication is shutting down

#219

Post by petepete » Fri, Aug 13, 2021, 6:37 AM UTC

tomrod wrote: post #87

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Github Desktop I've found to be an excellent way to get people into git generally. Those with proclivities to GUI get what the need, those that like to explore have some initial guardrails.

I've been training some non-technical folks at work to make content changes (mainly markdown) and GitHub Desktop is fantastic.

We start in the browser using the built-in editing functionality and build a PR, then when they're familiar with that we progress to GitHub Desktop and VS Code.

Worked really well so far, planning on trying both Codespaces and the `.` editor next.

Re: Git password authentication is shutting down

#220

Post by francislavoie » Fri, Aug 13, 2021, 6:37 AM UTC

happymellon wrote: post #217

francislavoie wrote: post #136

Earlier quoted context omitted.

I used GitExtension for years, but then I switched to Linux some years ago, so I had to find an alternative. I used SourceTree for a while, but I hated the UX. I tried GitKraken when it first came out, but it had a lot of issues that didn't make it appropriate for my workflow. After a couple more years, GitKraken had improved enough that I was able to switch to it. I've been using it for maybe 4 or 5 years now.

The pricing of GitKraken is a little frustrating. 5 pounds a month is quite a hefty price just to be able to use a private repo. Especially since it has not materially changed for my usage, so I would have been much happier giving them the £50 for a single licence. This is once of those scenarios where subscription for an enterprise might be a thing, but makes no sense for me. The JetBrains model would make sense and…

$5/m is honestly peanuts. The amount of value I get from it is way, way more than that. I pay it yearly, like I do for PHPStorm.