Live data from Hacker News

How to take credit for someone else's work on GitHub

repography.com

181–185 of 185 posts

Re: How to take credit for someone else's work on GitHub

#181

Sign your commits if you care about this! iirc, isn't signing with the same ssh key you push with a possibility?

I believe you could do that yes, but I don't think it's recommended.

My understanding is that git itself offers no real solutions to the questions of key-management, especially revocation and rotation, so you're essentially on your own for all of that.

Revocation seems especially tricky as it seems directly at odds with git's model of immutable commits. I don't know if there's a robust solution out there.

Re: How to take credit for someone else's work on GitHub

#182
post #179

Earlier quoted context omitted.

Because git is designed to be decentralised. You can push and pull changes to your coworkers' laptops, merge everything, and then push it to a centralised place like Github. Great for when you work at an office with limited internet connectivity or develop your code across multiple mirrors (gitlab + github, for example). Consider the way the Linux kernel is developed. Change sets are committed and emailed back and fo…

Yes, so GitHub showing the individual commit's email addresses and not replacing it with the name of an associated GitHub account wouldn't work ... because?

Because it doesn't solve anything without validation of email ownership. It doesn't matter if the commit says "Jen-Hsun Huang" or "ceo@nvidia.com". The commit usually contains both (in the "name " format) and both can be spoofed just as easily. The name associated with the email address of a Github account is actually harder to spoof because it requires creating an account with said email.

If people think "the" Linus Torvalds committed something just because they have a github account with the name Linus Torvalds, they're fools. Names aren't unique identifiers and they shouldn't be regarded as such.

There is something to be said got displaying the name and email address for signed commits on Github, to prevent creating an account and impersonating someone who actually signs their commits. In the default configuration, many version control systems will just add a "verified" badge to a commit if the email address of the signature matches an account with the same email address. That protection is obviously useless for unsigned commits, because there's no way to trust the author anyway, but for verified commits a clear indication of which email address created the commit makes sense. Alternatively, the github user account name could be used, of course, if such an account exists.

If you really want to find out the email address of the person who committed something, you can clone the repo and look at the git log manually, I suppose. I think hiding it was done to prevent shitty scrapers from collecting email addresses.

Re: How to take credit for someone else's work on GitHub

#183
post #39

Earlier quoted context omitted.

Does this redo all the commit hashes?

Yes, as it is rewriting history. And that would be a massively bad idea.

Thank you, wanted to know, if so, this should really be noted when suggesting these sort of things since it has unaccounted consequences especially when you consider most people use git but don't necessarily know how to use it beyond the basics.

Re: How to take credit for someone else's work on GitHub

#184

Because Git/Github is source control tool not a forensic tool.

This implies that assuring a commit's provenance is beyond the scope of git, which is wrong. Git supports cryptographic signing of commits for this purpose.

It implies such signing is nit used all the time

Re: How to take credit for someone else's work on GitHub

#185
post #179

Earlier quoted context omitted.

Yes, so GitHub showing the individual commit's email addresses and not replacing it with the name of an associated GitHub account wouldn't work ... because?

Because it doesn't solve anything without validation of email ownership. It doesn't matter if the commit says "Jen-Hsun Huang" or "ceo@nvidia.com". The commit usually contains both (in the "name " format) and both can be spoofed just as easily. The name associated with the email address of a Github account is actually harder to spoof because it requires creating an account with said email. If people think "the" Linus…

The difference though is, that this is about an existing commit. You can't change the mail address of the first commit to the git/git repository retroactively.

What you're describing is another issue.

Post reply on HN