Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

281–290 of 353 posts

Re: Git password authentication is shutting down

#281

Post by moonchrome »

sullyj3 wrote: post #247
csmpltn wrote: post #238

Earlier quoted context omitted.

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

> What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I mean, ideally, that'd be great. I don't think there's any fundamental reason things can't be this way, many of these complexities are completely incidental, rather than inherent. > Is it really too much to ask a newcomer to invest some hours into learning something these days? No, but when I'm learning so…

I get the argument but I disagree. Git is meant for software developers on projects complex enough to warrant using SCM.

Using SCM for teaching development to newbies is already adding unnecessary complexity (even in a collaborative setting, flows are complex enough to distract from more fundamental topics).

If you're a software developer getting to the point where using git is needed you should absolutely know the core concepts behind public key cryptography, it's going to come up everywhere and you can fuck up big time by publishing the wrong part.

Re: Git password authentication is shutting down

#282

Post by resonious »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Part of me wants to ask, why even use GitHub if you're struggling with "projects" and "ssh keys"? Just write code and run it on your machine. You can even just use git on your own machine without GitHub.

BUT, at the same time, I agree with you that the process of getting set up with GitHub is suboptimal. Have you used Heroku with git before? You run "heroku login" in the console, which then opens your browser. You sign in on the browser like normal and then the CLI magically knows who you are. You can then push and pull from heroku remotes with 0 friction. Maybe the GitHub CLI could/does have a feature like that.

Re: Git password authentication is shutting down

#283

Post by kkirsche »

moonchrome wrote: post #281
sullyj3 wrote: post #247

Earlier quoted context omitted.

> What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I mean, ideally, that'd be great. I don't think there's any fundamental reason things can't be this way, many of these complexities are completely incidental, rather than inherent. > Is it really too much to ask a newcomer to invest some hours into learning something these days? No, but when I'm learning so…

I get the argument but I disagree. Git is meant for software developers on projects complex enough to warrant using SCM. Using SCM for teaching development to newbies is already adding unnecessary complexity (even in a collaborative setting, flows are complex enough to distract from more fundamental topics). If you're a software developer getting to the point where using git is needed you should absolutely know the c…

It may be meant for software developers but has legitimate value in other domains. For example, DigitalOcean has their legal team use it as a way of providing diffs on their terms of service and other policies. This type of use case is where it benefits everyone, in my opinion, to reduce the friction to get started.

https://github.com/digitalocean/tos

There are plenty of text file versioning use cases I think, from configuration files for system administrators to LaTeX papers for science students who could benefit and should have an easy path to using it.

Re: Git password authentication is shutting down

#284

Post by erfgh »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

Why do we need a more gentle learning curve? Let them figure it out as everyone else did. There's more than enough information online.

Re: Git password authentication is shutting down

#285

Post by dragonwriter »

hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

> How can we offer a more gentle learning curve for budding developers while still requiring "real" projects to use best practices for security and development?

Those aren't goals that are in tension, but rather have pretty similar solutions..

The way for real projects to consistently follow the appropriate set of best practices applicable to their specific use case is for the project team to (1) identify what the appropriate practices are, (2) define workflows around them, and (3) build (or adopt existing, if available) tooling that wraps low level plumbing to implement the project workflows.

The way to offer a more gentle learning curve for budding developers is to...leave learning the details of low-level infrastructure tools for later, and to use workflow tools adapted for the project they are working on (whether its a real project or something one that is strictly pedagogical.)

Re: Git password authentication is shutting down

#286

Post by moonchrome »

kkirsche wrote: post #283
moonchrome wrote: post #281

Earlier quoted context omitted.

I get the argument but I disagree. Git is meant for software developers on projects complex enough to warrant using SCM. Using SCM for teaching development to newbies is already adding unnecessary complexity (even in a collaborative setting, flows are complex enough to distract from more fundamental topics). If you're a software developer getting to the point where using git is needed you should absolutely know the c…

It may be meant for software developers but has legitimate value in other domains. For example, DigitalOcean has their legal team use it as a way of providing diffs on their terms of service and other policies. This type of use case is where it benefits everyone, in my opinion, to reduce the friction to get started. https://github.com/digitalocean/tos There are plenty of text file versioning use cases I think, from c…

I agree with this, I don't know if GitHub already does this with their desktop GUI.

Re: Git password authentication is shutting down

#287

Post by dragonwriter »

moonchrome wrote: post #281
sullyj3 wrote: post #247

Earlier quoted context omitted.

> What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I mean, ideally, that'd be great. I don't think there's any fundamental reason things can't be this way, many of these complexities are completely incidental, rather than inherent. > Is it really too much to ask a newcomer to invest some hours into learning something these days? No, but when I'm learning so…

I get the argument but I disagree. Git is meant for software developers on projects complex enough to warrant using SCM. Using SCM for teaching development to newbies is already adding unnecessary complexity (even in a collaborative setting, flows are complex enough to distract from more fundamental topics). If you're a software developer getting to the point where using git is needed you should absolutely know the c…

> Git is meant for software developers on projects complex enough to warrant using SCM.

There is no such thing as a project not complex enough to warrant a SCM/VCS. There's probably an argument that there is a case where a DVCS is unnecessary, but if you aren't actually doing distributed work there's no reason you need to be aware of more complexity in a DVCS than a non-D VCS.

Re: Git password authentication is shutting down

#288

Post by cryvate1284 »

mukesh610 wrote: post #230
Androider wrote: post #26

Hopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week. GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no reposit…

You could always use "Deploy keys" which are per-repo read-only SSH keys. You could set up multiple repos with the same deploy key and use the private key in GitHub Actions secrets.

This won't work as a deploy key can only be used in one repo.

Re: Git password authentication is shutting down

#289

Post by sullyj3 »

moonchrome wrote: post #281
sullyj3 wrote: post #247

Earlier quoted context omitted.

> What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I mean, ideally, that'd be great. I don't think there's any fundamental reason things can't be this way, many of these complexities are completely incidental, rather than inherent. > Is it really too much to ask a newcomer to invest some hours into learning something these days? No, but when I'm learning so…

I get the argument but I disagree. Git is meant for software developers on projects complex enough to warrant using SCM. Using SCM for teaching development to newbies is already adding unnecessary complexity (even in a collaborative setting, flows are complex enough to distract from more fundamental topics). If you're a software developer getting to the point where using git is needed you should absolutely know the c…

Understanding the fundamentals of public key cryptography is a worthy pursuit. Memorizing the idiosyncratic flags of yet another command line tool (or looking them up in the man page every damn time like most people do), instead of having an interface that doesn't require you to relearn it every time you use it, isn't.

Re: Git password authentication is shutting down

#290

Post by GuB-42 »

DangitBobby wrote: post #130

For those of you who are saying you don't really "know" git, your VCS will be so so much less stressful if you take a day or so to learn it! I can't recommend this site enough for familiarity with the basics: https://learngitbranching.js.org/

The news is not actually about git, it is about GitHub. Maybe they should make it more explicit in the title.

Git still supports password authentication, as well as many other protocols. GitHub chose to restrict which protocols and authentication schemes are allowed on its platform.

But obviously, learning about the tools you are using is always a good idea.

My preferred "tutorial" is this one: https://codewords.recurse.com/issues/two/git-from-the-inside...

It is more advanced than the usual introductions but it demystifies most of the git concepts.

Post reply on HN