Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git password authentication is shutting down

github.blog

Post reply on HN
Print view View original

251–260 of 353 posts

Re: Git password authentication is shutting down

#251

Post by 10000truths »

benibela wrote: post #250
csmpltn wrote: post #238

Earlier quoted context omitted.

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

When I learned programming 20 years ago, it went like this Start QBASIC Enter: PRINT "Hello World!" Run the program. Congratulations, you wrote your first program and have become a software developer

Uh... you can still do that today.

    python3
    > print(“Hello world”)

Re: Git password authentication is shutting down

#253

Post by ovi256 »

benibela wrote: post #250
csmpltn wrote: post #238

Earlier quoted context omitted.

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

When I learned programming 20 years ago, it went like this Start QBASIC Enter: PRINT "Hello World!" Run the program. Congratulations, you wrote your first program and have become a software developer

You can still do that today!

Start ipython (or the interactive interpreter for your language)

Enter:

print("Hello World!") See the result!

Re: Git password authentication is shutting down

#254

Post by hortense »

peterburkimsher wrote: post #96
narraturgy wrote: post #46

Ok I'll admit it. I'm the dingus who is still using https and login/password. It's how I learned to use it years ago and since I only ever access GitHub via cli it's all I've ever learned. I don't program anything complex and I've never put anything secure up on GitHub (it's public, after all, so i had the expectation that all info on there is insecure). I don't understand why this is being deprecated when it's the d…

Thank you for being humble and describing the ways you use GitHub! I'm the same, and it's reassuring to know that I'm not the only one just using it as a free web host for personal projects. Until starting a new job in January 2021, I "knew git" to the extent of git pull, git add, git commit -m, and git push. For everything else I just made a copy of the repo. Now I've learned a little more about branches and merge r…

You can switch to bitbucket, they still support passwords.

Re: Git password authentication is shutting down

#256

Post by blowski »

csmpltn wrote: post #238
hiimshort wrote: post #24

I'm fine with this change for my usage, I don't think I've used password auth for myself or any automated service I've setup for years now. However, this will introduce more confusion for newcomers who already have to figure out what Git, GitHub, etc are. I just spent some time last weeekend teaching someone the basics of how to create a new project. Such a simple idea required introducing the terminal, basic termina…

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

Does it still take hours if you're using a client, like GitHub Desktop, SourceTree, or something like that?

Re: Git password authentication is shutting down

#257

Post by [deleted] »

vtbassmatt wrote: post #35

Disclosure: I'm the Git Systems PM at GitHub. Opinions are my own and I wasn't directly involved with this effort. GCM Core is a really straightforward way to auth with GitHub and several other Git hosts. It comes with Git for Windows by default, can be installed with `brew` on macOS, and from a .deb on Linux. https://github.com/microsoft/Git-Credential-Manager-Core (it started under the Microsoft banner but is maint…

[deleted]

Re: Git password authentication is shutting down

#258

Post by formerly_proven »

blowski wrote: post #256
csmpltn wrote: post #238

Earlier quoted context omitted.

> "Such a simple idea required introducing the terminal, basic terminal commands, GitHub, git and its most common commands. It took about 3 hours for us to get through just the most basic pieces." I don't get this. "Can you imagine? Learning to program a computer took us some hours!" What do you expect? That people without prior knowledge or experience just pick up source control in seconds? I'm honestly wondering -…

Does it still take hours if you're using a client, like GitHub Desktop, SourceTree, or something like that?

No, but doing so results in learned helplessness. "Whoopsie, a fucky wucky happened and the GUI I use for git made a big mess. I'm going to delete my repo and clone it again."

Re: Git password authentication is shutting down

#259

Post by tialaramex »

HeckFeck wrote: post #37
jrockway wrote: post #14

Earlier quoted context omitted.

Passwords are probably one of the worst things to happen to our field as a whole (phishing, password managers, etc. are the results of their ubiquity), so efforts to remove them are probably not part of some Microsoft plan to kill open source. This change is a good thing.

Indeed. I wish there was something like a token or key that was as ubiquitous as passwords. Though from a developer POV I can certainly see why passwords are so attractive: take a word, hash it, compare hash on subsequent logins. The alternatives are tricky, but not I suspect impossible, to do in a decentralised manner. I've often pondered that something like PGP servers with revocation certificates, but adapted to l…

Our best hope is WebAuthn.

For the user this is extremely simple. For the programmers it's a bunch of new stuff to learn (or a new library to pull in) when implementing it, including things like you're going to want a whole new RDBMS table not just a wider "password" in the database - but for the user it's very simple and impossible to get wrong.

I implemented it by hand for my vanity site, it was not a tremendous amount of work. GitHub - since they are the topic after all - offers it today. But beyond big hitters (e.g. Gmail, Facebook) I am disappointed by how few have bothered.

It's a night and day difference in terms of security and in terms of ease of use but it seems most places aren't interested in doing more than the very bare minimum.

Re: Git password authentication is shutting down

#260

Post by dagw »

formerly_proven wrote: post #258
blowski wrote: post #256

Earlier quoted context omitted.

Does it still take hours if you're using a client, like GitHub Desktop, SourceTree, or something like that?

No, but doing so results in learned helplessness. "Whoopsie, a fucky wucky happened and the GUI I use for git made a big mess. I'm going to delete my repo and clone it again."

Why do you think using a GUI will make it more likely to fuck up your repo than a using the CLI? Most git GUIs are actually better at warning you that you might be about to do something stupid and making the consequences of you actions more visually clear.
Post reply on HN