Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to take credit for someone else's work on GitHub

repography.com

Post reply on HN
Print view View original

101–110 of 185 posts

Re: How to take credit for someone else's work on GitHub

#101

Post by marwis »

nfoz wrote: post #84

Veering off topic but I absolutely hate that git requires you to have an "email address" (which cannot be empty and iirc must satisfy some regex criteria for a valid-looking address). A particular choice of user identifier or communication medium should not be hardcoded into the totally unrelated concern of source-control, IMO. Anonymous and non-email accounts should be first-class things. Instead of email maybe you'…

Nothing is stopping you from using anonymous@localhost or YOUR_KEY_ID@publickey

Re: How to take credit for someone else's work on GitHub

#102

Post by nebulous1 »

MereInterest wrote: post #26
rockbruno wrote: post #6

It seems that one proper solution could be: 1 - Don't associate the commit to an account if the email is unverified, obviously 2 - If someone tries to "forge" ownership by pushing a commit with an e-mail that doesn't belong to the GitHub account being used to push, a "unverified" warning should be added to the commit and manually claimed by the account owning said e-mail for its status to change.

That would break any workflow that has the slightest bit of decentralization, and would only work in a github-first workflow. Suppose two developers are working on a feature that requires two changes. Each developer works on a change in their own development branch. It wouldn't make sense to submit a PR for each change, because they depend on each other to be a complete feature. Therefore, they should merge the two d…

> this would then show up as an attempted forgery, rather than a perfectly normal workflow.

they said unverified, not marked as a forgery

> The email field is for humans, who can lie, and shouldn't be used as authoritative by github.

and your solution is just to have everything marked as unverified, including commits that I push using my credentials and contain an email that I've verified with github.

Re: How to take credit for someone else's work on GitHub

#103

Post by progval »

giancarlostoro wrote: post #36
baobabKoodaa wrote: post #19

Earlier quoted context omitted.

> If GitHub required email address verification, how would this be done? You could just run a script which rewrites the email address in all the git commits, and force-push the revised version.

Does this redo all the commit hashes?

Given that GGP's use case is:

> we have imported our entire project's history going back to the very first commit into git

Then it isn't a problem. Just change the email addresses while importing.

Re: How to take credit for someone else's work on GitHub

#105

Post by kreetx »

jodrellblank wrote: post #90
d23 wrote: post #83

Earlier quoted context omitted.

> This case might not be super important in the long run, but why does it have to be a fact of life? For the very reason mentioned in this article: people can claim the commits without verification.

Why doesn't the fact of life go the other way? " people can claim the commits without verification. " - Well, tough luck? I don't think it's that important. Just accept it as a fact of life. You didn't cryptographically sign your commit and now nobody (including you) can prove who made it.

I think the issue is that this isn't a "fact of life", so github could either show the original email or pull in the account with a verified email. What it does now appears to be a bug.

Re: How to take credit for someone else's work on GitHub

#106

Post by kelnos »

jodrellblank wrote: post #90
d23 wrote: post #83

Earlier quoted context omitted.

> This case might not be super important in the long run, but why does it have to be a fact of life? For the very reason mentioned in this article: people can claim the commits without verification.

Why doesn't the fact of life go the other way? " people can claim the commits without verification. " - Well, tough luck? I don't think it's that important. Just accept it as a fact of life. You didn't cryptographically sign your commit and now nobody (including you) can prove who made it.

The distinction is in where the potential harm can be.

With the current status quo (unverified email addresses can "steal" commits), you create confusion in the general developer community. Anyone who looks at those mis-attributed commits will be confused, and possibly misled.

If GH didn't associate commits unless the email address was verified, then, yes, some people wouldn't get "bragging rights", but the harm would be limited to that person. Others who look at those commits would still see the correct person's name, even though it wouldn't be associated with a particular GH account.

Re: How to take credit for someone else's work on GitHub

#107

Post by leeoniya »

jodrellblank wrote: post #94
uncomputation wrote: post #3

GitHub’s response is pretty surprising. How can anyone think this is expected? Having to follow Git’s commit message emails makes sense and indeed anybody can use any email they want to make a commit. But then for GitHub to make the connection between (unverified) commit emails and (unverified) GitHub.com accounts is the issue for me. Since they can’t verify the commit email belongs to a GitHub account, why show that…

What happens if Linus Torvalds has a verified Github account, and I commit to my rudely named project on my local computer with his email address and then push to Github; do they then show the commit with his Github account because his Github email is verified?

> and I commit to my rudely named project on my local computer with his email address

and how exactly would this be out of character for the real Linus Torvalds?

Re: How to take credit for someone else's work on GitHub

#109

Post by hyperhopper »

totony wrote: post #99
bluGill wrote: post #86

Earlier quoted context omitted.

That isn't fair either though. I can see the ISP I quit using 15 years ago letting someone else have my old email address, but now they can claim to be me. I don't know how to handle this situation. It is somewhat easy to verify that a commit today comes from an email address I control now. However if I claim an unverified commit from years back is it really me just because I now control that email?

What does it matter if someone can claim your commits? Doesn't seem important imo.

Since [by default] you own the IP for code you commit, this is effectively claiming to steal intellectual property. Also professional credit and fame, which can directly relate to employment opportunities.

Re: How to take credit for someone else's work on GitHub

#110

Post by heleninboodler »

anandoza wrote: post #61

Could someone also write bad code and commit it using someone else's email address in the commit message, thus making the commit link to the other person's Github profile? (Sort of the reverse problem -- "giving blame" instead of "taking credit")

Or use it for clout-chasing by getting big names in your contributors list. :D
Post reply on HN