Live data from Hacker News

Git password authentication is shutting down

github.blog

291–300 of 353 posts

Re: Git password authentication is shutting down

#291
post #59

For any Githubbers reading, my coworker was apparently affected by a brownout window and changed to using a personal access token. He didn't know it at the time but I just mentioned the period and it lines up with when had issues with his authentication. Seems like the brownout was a success in our case!

Similar here, though we did narrow it down to the cause/brownout at the time.

Re: Git password authentication is shutting down

#292

Earlier quoted context omitted.

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

When I learned programming 20 years ago, it went like this Start QBASIC Enter: PRINT "Hello World!" Run the program. Congratulations, you wrote your first program and have become a software developer

Right click -> Inspect, Console, 'alert("Hello World!")'

Re: Git password authentication is shutting down

#293

Earlier quoted context omitted.

I just have non-devs use the browser interface and this seems to work for text edits and image uploads and stuff. And some statisticians and stuff only know how to use the GitHub desktop client and that works ok for 99% of them. Drives me crazy because I only use cli and struggle to help when they get blocked with the client.

The cynic in me says they’re taking advantage of the fact that the web UI is a lower friction experience to drive more people towards Codespaces (which are not cheap, by the way).

Maybe you could tell your cynic that web Interface are intrinsically easier for people used to them, and that for GitHub, the difference hasn’t changed since times when Codespaces neither existed nor were even planned.

Re: Git password authentication is shutting down

#295

Earlier quoted context omitted.

> What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I mean, ideally, that'd be great. I don't think there's any fundamental reason things can't be this way, many of these complexities are completely incidental, rather than inherent. > Is it really too much to ask a newcomer to invest some hours into learning something these days? No, but when I'm learning so…

I get the argument but I disagree. Git is meant for software developers on projects complex enough to warrant using SCM. Using SCM for teaching development to newbies is already adding unnecessary complexity (even in a collaborative setting, flows are complex enough to distract from more fundamental topics). If you're a software developer getting to the point where using git is needed you should absolutely know the c…

This would be a reasonable point to make if there were reasonable alternatives for simpler version control. But for better or worse the world has standardized on git for all version control. If you want your "two phd student implement a new algorithm in a small python/julia package" to be found/used/talked about you need to be on github.

Heck even if you want to host a static site you probably want to just be on github these days.

Yet to me there is no reason for version control to be this complex. The current github + git universe is locked in, but I don't see why it should be optimal.

Re: Git password authentication is shutting down

#297

Hopefully they'll enhance the other authentication methods. I was quite surprised how complicated yet insecure the GitHub Actions and personal access token mechanisms are just last week. GitHub Actions tokens are scoped to the single repo they operate in, so for anything that you need covering any cross-repository or org access the official docs immediately tell you to just use a PAT instead. But PATs have no reposit…

The current suggested solution is to create a new user just for that repo and create a PAT in that user. So the PAT will only have access to that repo.

Re: Git password authentication is shutting down

#298

Earlier quoted context omitted.

Most people want to just code, not putz around for hours wrestling with dev environments and tooling.

Are those the same people that will add security, maintainability, performance and logging "later"?

Well, management did say it would be okay to leave it for after the new feature release…

Re: Git password authentication is shutting down

#299

Earlier quoted context omitted.

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

> "Can you imagine? Learning to program a computer took us some hours!" I wouldn't call installing a vcs "learning to program". A better analogy might be: "Can you imagine, opening an A4 notepad to take lecture notes took us some hours" Not a perfect analogy I know but "setting up tools to start learning" != "learning completely" Either way, I don't really get this kind of aggressive resistance to making things more…

> A better analogy might be: "Can you imagine, opening an A4 notepad to take lecture notes took us some hours"

And using a notepad to take notes relies on your having learnt how to read and write in general, which took a significant amount of time.

That being said, I agree with it being good to try make things as accessible as possible, so long as it doesn't impact overall utility.

Re: Git password authentication is shutting down

#300
While it is a clear win for security, git password auth is still part of the regular api that git provide. I get that github is big enough to set their own standard, but oftentime, when other big companies did that (Microsoft, Google, etc.) it ended up being detrimental to the global ecosystem. Of course it doesn't have to be here...
Post reply on HN