Their response is to add a PGP key. But AFAICT they don't do verification on PGP keys either. So you could do the same.
How to take credit for someone else's work on GitHub
21–30 of 185 posts
Re: How to take credit for someone else's work on GitHub
#22so this is obviously an ad for this repography thing, which looks pretty cool.
so.. does it do anything interesting with stuff like git blame -CCC which shows the genealogy of copypasta across time within a repo?
Re: How to take credit for someone else's work on GitHub
#23I thought this might be something different. Have seen this happen multiple times over the years - even once just last week.
Colleague files an issue with a PR. Project owners close it, say 'no, not a bug', then... commits the same thing themselves as "fixed!". Saw this years before in cvs/svn, and... at least in the GH world there's some evidence of the original PR author having done the work in the first place (vs being invisibly cut out).
Re: How to take credit for someone else's work on GitHub
#24Arpad, your site looks like this - https://i.imgur.com/jj9Uxbl.png Not just the linked page, the homepage too. All but illegible. That's in a recent Firefox on Windows. Just FYI.
At some point, we need to start treating Windows like Internet Explorer or Safari. Things break on it all the time, completely unpredictably, and it doesn't support many useful features you'd expect to be used.
We should really just tell Windows users to upgrade to a real operating system, rather than go out of our way to support it.
Re: How to take credit for someone else's work on GitHub
#25I remember this earlier subthread where someone was criticizing GitHub for allowing this (even using Torvald as someone to impersonate!), and others offered some defenses (which were IMHO dubious):
https://news.ycombinator.com/item?id=21025378
Also, semi-related, obligatory mention of my joke utility for stealing credit for someone else's work:
https://github.com/silasx/git-upstage
Finally, I thought this phrasing was funny, like commits have a non-substantively transferable ownership, like an NFT (though FYI it's quoting an older discussion of the same problem):
>Someone wrote about the whole situation on Medium in November 2021: "The 1st commit of git/git no longer belongs to Linus Torvalds".
Re: How to take credit for someone else's work on GitHub
#26It seems that one proper solution could be: 1 - Don't associate the commit to an account if the email is unverified, obviously 2 - If someone tries to "forge" ownership by pushing a commit with an e-mail that doesn't belong to the GitHub account being used to push, a "unverified" warning should be added to the commit and manually claimed by the account owning said e-mail for its status to change.
That would break any workflow that has the slightest bit of decentralization, and would only work in a github-first workflow. Suppose two developers are working on a feature that requires two changes. Each developer works on a change in their own development branch. It wouldn't make sense to submit a PR for each change, because they depend on each other to be a complete feature. Therefore, they should merge the two dev branches together, then submit a pull request for that merged development branch to then be merged into the main branch. In your proposed scheme, this would then show up as an attempted forgery, rather than a perfectly normal workflow.
The email field is for humans, who can lie, and shouldn't be used as authoritative by github.
Re: How to take credit for someone else's work on GitHub
#27I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…
In this case I think you could use a .mailmap [1] in the repo to associate the old email addresses with current, verified addresses.
Re: How to take credit for someone else's work on GitHub
#28Their response is to add a PGP key. But AFAICT they don't do verification on PGP keys either. So you could do the same.
Really? GH Enterprise definitely verifies GPG.
Re: How to take credit for someone else's work on GitHub
#29Re: How to take credit for someone else's work on GitHub
#30Arpad, your site looks like this - https://i.imgur.com/jj9Uxbl.png Not just the linked page, the homepage too. All but illegible. That's in a recent Firefox on Windows. Just FYI.
At some point, we need to start treating Windows like Internet Explorer or Safari. Things break on it all the time, completely unpredictably, and it doesn't support many useful features you'd expect to be used. We should really just tell Windows users to upgrade to a real operating system, rather than go out of our way to support it.
I love comparing these kinds of comments to articles like this: https://sporks.space/2022/02/27/win32-is-the-stable-linux-us...
You really think businesses like Repography should just ignore the OS with 80% marketshare?