Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

261–270 of 353 posts

Re: Git password authentication is shutting down

#261

Post by tialaramex »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

You're not going to be able to avoid that ssh-keygen step.

"Pick a huge random number, this is a private key, you must never tell anybody else this key" is a fundamental operation. If they've never done this operation, that's more telling us how bad a job we did securing everything else than a problem with software development.

If the argument was, "But my users all have perfectly nice long term private keys for some other system" then we could leverage that to get keys to make GitHub work, but in reality that's not the case. SSH keys are likely the most common private key† full stop even though they're only needed to do the 21st century equivalent of telnet

† For people anyway, for machines Let's Encrypt means there are an eye-watering number of new private keys minted each day by Certbot and similar tools.

Re: Git password authentication is shutting down

#262

Post by trophycase »

csmpltn wrote: post #238
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

Most people want to just code, not putz around for hours wrestling with dev environments and tooling.

Re: Git password authentication is shutting down

#264

Post by capableweb »

funcDropShadow wrote: post #263

This should reflect in the title that it is about GitHub, not about git.

It's pretty obvious. Git itself doesn't have password authentication (I mean locally/repo-level, only on the transport level) and it can't be "shut down", only "removed" or "unsupported"/"deprecated".

Also, you can see the domain right next to the submission title.

Re: Git password authentication is shutting down

#266

Post by 90211 »

jrockway wrote: post #14
ushakov wrote: post #7

Embrace. Extend. Extinguish

Passwords are probably one of the worst things to happen to our field as a whole (phishing, password managers, etc. are the results of their ubiquity), so efforts to remove them are probably not part of some Microsoft plan to kill open source. This change is a good thing.

Not everything needs perfect OpSec. sometimes convenience is more important. I don't care if my HN account gets hacked and if I was forced to use 2FA I would just stop using it.

Passwords have security vulnerabilities, sure. But they're intuitive and usable. When you start trying to come up with alternatives there become dozens of edge-cases in which your system fails.

Re: Git password authentication is shutting down

#267

Post by lucideer »

csmpltn wrote: post #238
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

> "Can you imagine? Learning to program a computer took us some hours!"

I wouldn't call installing a vcs "learning to program".

A better analogy might be: "Can you imagine, opening an A4 notepad to take lecture notes took us some hours"

Not a perfect analogy I know but "setting up tools to start learning" != "learning completely"

Either way, I don't really get this kind of aggressive resistance to making things more accessible...

Re: Git password authentication is shutting down

#268

Post by bspammer »

10000truths wrote: post #251
benibela wrote: post #250

Earlier quoted context omitted.

When I learned programming 20 years ago, it went like this Start QBASIC Enter: PRINT "Hello World!" Run the program. Congratulations, you wrote your first program and have become a software developer

Uh... you can still do that today. python3 > print(“Hello world”)

You’re missing the “install python” step.

Oh and probably you should be using a package manager to do it so figure out which one’s on your system first and learn its interface.

Oh and it’s best practice to create projects in a virtualenv so install that too, and learn how to use it.

Re: Git password authentication is shutting down

#269

Post by account42 »

jcrites wrote: post #156
DangitBobby wrote: post #149

Earlier quoted context omitted.

I actually don't want to rebase. Rebase can rewrite your local history and make it impossible for you to push without doing a force push (or some other more complicated manuevering). The only time pull with rebase is okay (on a shared branch such as master) is when you know that your local branch is strictly behind remote. That's exactly what --ff-only does. It rebases only if you are behind remote, and declines to d…

If "git pull --rebase" succeeds without reporting a merge conflict, then it's tantamount to having executed the command with "--ff-only". I believe you are incorrect however. "git pulll --rebase" will not ever rewrite history from the origin repository. It will only ever modify your local unpublished commits to account for new commits from the origin branch. If your change and the new commits from origin aren't touch…

> I was in the habit of committing and pushing to the private repo about once every 30m-1h (to eliminate the chance of major work loss due to hardware failure).

I get pushing every day, but how unreliable does your PC have to be if you feel you need to push every hour???

> (And even that operation would show up in the system's logs, so in the case of something like credentials you'd additionally contact the security or source control team to make sure the commit objects containing the credentials were actually deleted out of the repo history completely, including stuff you can find only via the reflog.)

You can't un-leak credentials. The only valid action for leaked credentials is to invalidate them, not to pretend that they were never leaked.

Re: Git password authentication is shutting down

#270

Post by nemetroid »

10000truths wrote: post #251
benibela wrote: post #250

Earlier quoted context omitted.

When I learned programming 20 years ago, it went like this Start QBASIC Enter: PRINT "Hello World!" Run the program. Congratulations, you wrote your first program and have become a software developer

Uh... you can still do that today. python3 > print(“Hello world”)

  >>> print(“Hello world”)
    File "", line 1
      print(“Hello world”)
            ^
  SyntaxError: invalid character '“' (U+201C)
Post reply on HN