Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to take credit for someone else's work on GitHub

repography.com

Post reply on HN
Print view View original

151–160 of 185 posts

Re: How to take credit for someone else's work on GitHub

#151

Post by DyslexicAtheist »

res0nat0r wrote: post #125
nynyny7 wrote: post #7

I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…

If everyone is concerned about commit identity hijacking, you can configure your repo settings to reject any commits which aren't GPG signed. https://docs.github.com/en/authentication/managing-commit-si... https://www.devopsauthority.tech/2020/07/18/github-getting-s...

that's great but it requires an active step on behalf of the user which is violating secure defaults principle. it also violates the principle of good UE

Re: How to take credit for someone else's work on GitHub

#152

Post by krageon »

hyperhopper wrote: post #109
totony wrote: post #99

Earlier quoted context omitted.

What does it matter if someone can claim your commits? Doesn't seem important imo.

Since [by default] you own the IP for code you commit, this is effectively claiming to steal intellectual property. Also professional credit and fame, which can directly relate to employment opportunities.

> intellectual property

This seems to me to be the least important aspect of whatever is happening.

> can directly relate to employment opportunities

Given how free we are in choosing work, it seems to me you could just go work for a workplace that doesn't trawl through your charity history to figure out you're worthy enough. That's a matter of self-respect, which you should absolutely have.

Re: How to take credit for someone else's work on GitHub

#153

Post by Cthulhu_ »

nynyny7 wrote: post #7

I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…

> Still they want the commits to be associated with their current GitHub account; even if it's just for statistics and "bragging rights".

> If GitHub required email address verification, how would this be done?

If it can't be done securely - e.g. you verify you own the e-mail address - it shouldn't be done, IMO. It's like losing your 2FA token and all recovery methods; for the sake of security, you should consider that account lost. Because if you can get it back through other means, then a scammer / impostor can do so as well.

At some point you just have to give up. Anyway in the case of e-mail addresses, ideally you have your real name in the address itself for anything formal / work related.

Alternatively, what GitHub could do is mark these accounts as unverified. It would also mean they should allow multiple user accounts to be associated with a commit's e-mail address though.

And finally, some manual work might be involved. I'm sure there would be ways and means to get verified on github (like on twitter), and somehow claim that e-mail address in a more formalized fashion - and to dispute it. In the case of Linux and Go, it's obvious and well-known who the original authors / committers are, so a bit of manual work to associate those commits to a GH account shouldn't be too much of an issue.

Re: How to take credit for someone else's work on GitHub

#154

Post by Cthulhu_ »

remram wrote: post #137
Aeolun wrote: post #115

Earlier quoted context omitted.

Whatever is in the branch you are looking at? Seems fairly straightforward.

Viewing a specific commit or viewing the repositories' statistics ("insights" tab) both have no attached branch.

in Github or in Git itself? While possible, I don't believe there's many floating commits around.

The other issue of course is that at this point in time, there would not be a .mailmap. Of course, github can then fall back to a .mailmap file in the latest commit of the main branch.

Re: How to take credit for someone else's work on GitHub

#155

Post by Cthulhu_ »

progval wrote: post #103
giancarlostoro wrote: post #36

Earlier quoted context omitted.

Does this redo all the commit hashes?

Given that GGP's use case is: > we have imported our entire project's history going back to the very first commit into git Then it isn't a problem. Just change the email addresses while importing.

But what if you don't think of it at the time?

Or what if you don't actually want to change the e-mail addresses because they are important historic data? or part of a commit's signature?

Re: How to take credit for someone else's work on GitHub

#156

Post by worldsayshi »

nynyny7 wrote: post #7

I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…

You could just flair the username as unverified and have the flair link to an explanation.

Re: How to take credit for someone else's work on GitHub

#157

Post by bluGill »

krageon wrote: post #152
hyperhopper wrote: post #109

Earlier quoted context omitted.

Since [by default] you own the IP for code you commit, this is effectively claiming to steal intellectual property. Also professional credit and fame, which can directly relate to employment opportunities.

> intellectual property This seems to me to be the least important aspect of whatever is happening. > can directly relate to employment opportunities Given how free we are in choosing work, it seems to me you could just go work for a workplace that doesn't trawl through your charity history to figure out you're worthy enough. That's a matter of self-respect, which you should absolutely have.

Given few programmers have open source work on their résumé that doesn't really matter, more just pride.

Re: How to take credit for someone else's work on GitHub

#158

Post by bluGill »

flippinburgers wrote: post #136
bluGill wrote: post #86

Earlier quoted context omitted.

That isn't fair either though. I can see the ISP I quit using 15 years ago letting someone else have my old email address, but now they can claim to be me. I don't know how to handle this situation. It is somewhat easy to verify that a commit today comes from an email address I control now. However if I claim an unverified commit from years back is it really me just because I now control that email?

Sign your commits.

That is the right answer, but it means 15 years ago you need to have done the right thing, and also means not losing the private key (which should have expired) in the mean time.

Re: How to take credit for someone else's work on GitHub

#159

Post by jhasse »

jeroenhd wrote: post #139
kazinator wrote: post #76

In spite of GitHub's claims that nothing wrong, something is wrong and fixable. GitHub should be showing the identity pulled from the e-mail address, and not replacing it with the name of an associated GitHub account. Just like it does when there is no associated GH account. A reasonable compromise would be to show that name, but turn it into a link to the account if there is one. Then only someone curious clicking o…

That wouldn't work, for example, when you're pushing commits someone else did in another repository. Git is decentralized, so you end up pushing a lot of code that you didn't commit if you use it the way it was intended. The solution, in my opinion, is to show a great big warning or error icon next to the name of every unverified commit, and to every unverified push as well. Developers and version control managers ca…

> That wouldn't work, for example, when you're pushing commits someone else did in another repository.

What? Why??

Re: How to take credit for someone else's work on GitHub

#160

Post by seba_dos1 »

charcircuit wrote: post #138
jreese wrote: post #120

Earlier quoted context omitted.

Yes, and there are a number of past stunts that include forking the Linux repo, pushing fake/misleading commits, and then showing how Github lets you see those commits in a context that implies they are part of the upstream Linux repo.

Github now shows a warning when people visit links like that

Not on every relevant view though, so there are still new waves of pranks and surprised people.
Post reply on HN