Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

221–230 of 353 posts

Re: Git password authentication is shutting down

#221

Post by happymellon »

u801e wrote: post #209
BeefySwain wrote: post #39

Earlier quoted context omitted.

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

> I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The question really should be why do we want to use git for version control when people really want an backup system where they can essential…

Especially when they use tools that make files that contain all the history through "non-destructive changes" anyway.

But I think the reason is because the mess of folders they then create in DropBox and they can never find their files.

What would be great is if someone could make a TimeMachine for non-developers that uses git, because that is what they are doing in their heads anywy.

Re: Git password authentication is shutting down

#223

Post by happymellon »

francislavoie wrote: post #220
happymellon wrote: post #217

Earlier quoted context omitted.

The pricing of GitKraken is a little frustrating. 5 pounds a month is quite a hefty price just to be able to use a private repo. Especially since it has not materially changed for my usage, so I would have been much happier giving them the £50 for a single licence. This is once of those scenarios where subscription for an enterprise might be a thing, but makes no sense for me. The JetBrains model would make sense and…

$5/m is honestly peanuts. The amount of value I get from it is way, way more than that. I pay it yearly, like I do for PHPStorm.

But if you get no value from PHPStorm you can stop paying for it and you do not lose access unlike a subscription.

You just don't get new features.

My issue is that I do not get £5 worth of value each month from GitKraken. I get value every couple of months, and it is to explain to other people what they are doing wrong rather than direct value for me.

Re: Git password authentication is shutting down

#224

Post by dheera »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

What can we do? Automate all of it in a nice interface that does everything for you. Make it as easy as certbot is now. Something like this, perhaps?

   $ git add-ssh-key github.com
   Checking for ssh key ... not found
   Generating ssh key for you (ssh-keygen -t rsa)... done
   Enter username for github.com: alberteinstein
   Enter account password for alberteinstein@github.com: **********
   Touch your Yubikey now: 
   Uploading public key ... done
   Welcome to Github!

   $ git clone git@github.com:username/someprivaterepo

Re: Git password authentication is shutting down

#225

Post by Noumenon72 »

buck4roo wrote: post #179
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

For the love of humanity, pick a better tool to teach: Mercurial. Even teaching SVN would be easier. Both interop with github just fine. Anything but git. Git was definitely not designed for ease-of-use. Only Linus and friends need or use 90% of git's features.

I feel that PyCharm's Git client is just as graphical/easy to use as TortoiseHg was. Version control shouldn't need the command line, it should all be pretty trees. That's the only thing I really preferred about Mercurial. I liked mq patches, but PyCharm's shelf beats the pants off them.

Re: Git password authentication is shutting down

#226

Post by niffydroid »

Androider wrote: post #26

Hopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week. GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no reposit…

The scoping of pat currently are terrible. If I want a read only access token, the user needs to be read only, if I went write, user needs write permissions. This means I need 2 users

Re: Git password authentication is shutting down

#227

Post by matkoniecz »

BeefySwain wrote: post #39
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

I also have found teaching someone how to be even marginally capable of contributing to a Github project from scratch to be a very time consuming and frustrating thing. Think, having your graphics designer able to make commits, or having someone who only wants to update docs. The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up…

> The worst part is the "easier" solutions are actually just footguns in disguise, as soon as they accidentally click the wrong thing and end up with a detached HEAD, a few commits ahead and behind the REMOTE, and halfway through a botched merge

Is graphic designer even going to be able to merge things in their files?

It seems that "overwrite my files by data in repository" "apply my changes with message" are all what is necessary? Or is it case of multiple nontechnical people editing files together and expecting to merge changes?

Re: Git password authentication is shutting down

#228

Post by throwaway2037 »

sethammons wrote: post #169
geofft wrote: post #93

Earlier quoted context omitted.

Piping the output of curl to bash is not "bad practice" any more that downloading an application from your browser and clicking on it or downloading a distro CD/USB image and booting it up "bad practice." You have to trust the place where you're downloading it from, of course. But there's nothing inherently worse about /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/inst... )" than…

You can actually detect from the server side if curl is being piped and dynamically change the payload.

Woah. How? Assume scrubber request headers.

Re: Git password authentication is shutting down

#229

Post by jusssi »

tcoff91 wrote: post #44
hiimshort wrote: post #32

Earlier quoted context omitted.

In this case it is a younger college student who's interested in web development but hasn't done any CS learning and isn't generally familiar with tech.

Does someone who just wants to experiment with a little bit of web-dev really need to have version control right away? Seems a bit out of scope. That seems like a concept that can wait a few months while they actually just explore writing some code first.

In the context of learning at work, there's a good chance they'll be trying to make some minor changes in an existing project, instead of doing something from scratch. For that they need to interact with the CVS.

Re: Git password authentication is shutting down

#230

Post by mukesh610 »

Androider wrote: post #26

Hopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week. GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no reposit…

You could always use "Deploy keys" which are per-repo read-only SSH keys. You could set up multiple repos with the same deploy key and use the private key in GitHub Actions secrets.
Post reply on HN