Just ask Sushi Swap.
How to take credit for someone else's work on GitHub
161–170 of 185 posts
Re: How to take credit for someone else's work on GitHub
#162Whether working as expected or not, just fix the Linus thing, that is an embarrassment and a surreal one at that.
Re: How to take credit for someone else's work on GitHub
#163I scrolled through all the comments and didn’t see this answer.
What better way to recruit famous people to your platform than to allow people to trivially claim their commits until and unless they join and claim them?
It is most likely driven by customer acquisition — hence the response “working as expected!”
Re: How to take credit for someone else's work on GitHub
#164I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…
>If GitHub required email address verification, how would this be done?
author data in a commit can be replaced by repository owners. You can replace all old email addresses to new ones https://github.com/jayphelps/git-blame-someone-else https://github.com/SilasX/git-upstage
Re: How to take credit for someone else's work on GitHub
#165I scrolled through all the comments and didn’t see this answer. What better way to recruit famous people to your platform than to allow people to trivially claim their commits until and unless they join and claim them? It is most likely driven by customer acquisition — hence the response “working as expected!”
Github has made multiple decisions which, whatever the rationale, damage trust in them as an identity authority and make it more difficult to believe that a Github account represents who it appears to.
They also allow for accounts to be renamed and then for someone unrelated to register the abandoned name:
https://www.theregister.com/2018/02/10/github_account_name_r...
Re: How to take credit for someone else's work on GitHub
#166I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…
>If GitHub required email address verification, how would this be done? author data in a commit can be replaced by repository owners. You can replace all old email addresses to new ones https://github.com/jayphelps/git-blame-someone-else https://github.com/SilasX/git-upstage
Doesn't changing the author affect the commit sha? If so, doing this would cause some amount of pain with syncing all copies of the repo, branches, etc, making it a non-starter I think.
Re: How to take credit for someone else's work on GitHub
#167Earlier quoted context omitted.
As I understand it, this is not permitted under the GNU General Public License v3.0. Is that correct? I would think that certain licenses do permit this (MIT possibly?). Could anybody with knowledge chime in?
I assume copyright law prohibits this too.
Copyright law doesn't care about copyright notices. They are informational and not necessary or sufficient to enforce copyright.
Re: How to take credit for someone else's work on GitHub
#168Their response is to add a PGP key. But AFAICT they don't do verification on PGP keys either. So you could do the same.
Really? GH Enterprise definitely verifies GPG.
How does it verify them? They could ask you to sign a message to prove that you control the private key, but I don't think public Github (or Gitlab) does this. They just assume you hold the private key to any pubkey you upload. Alternatively your private installation could have a centralised trust store of keys.
Re: How to take credit for someone else's work on GitHub
#169Earlier quoted context omitted.
If everyone is concerned about commit identity hijacking, you can configure your repo settings to reject any commits which aren't GPG signed. https://docs.github.com/en/authentication/managing-commit-si... https://www.devopsauthority.tech/2020/07/18/github-getting-s...
that's great but it requires an active step on behalf of the user which is violating secure defaults principle. it also violates the principle of good UE
Security requirements are often at odds with good UE.
Re: How to take credit for someone else's work on GitHub
#170This reminds me very much of a "hack" I performed in a workplace that used Outlook/Exchange as its primary email system. I simply sent an email (to a few, trusted people) with the "from" field set to the CEO's name/address.
In their inbox it looked completely legit. Outlook even put the CEO's avatar next to it and everything. They were genuinely shocked. Even after I explain that the "from" field is just like me writing "love from Mum" at the bottom of a letter I think they still couldn't believe it.
There is a problem with people assuming that all data they find is authoritative. People don't question whether they can trust data often enough. Another problem is when you make things look nice enough, they look trustworthy. This is a well known confidence trick, of course.
My PhD supervisor objected to me typesetting my work in LaTeX before it had been checked because he said once it's typeset it looks correct, but might still be complete rubbish.
Unfortunately this all boils down to web-of-trust, as usual. We've had the solution for decades now, but we've collectively agreed that it's more trouble than it's worth. So these kinds of problems will keep popping up again and again.