Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git-blame-someone-else – Blame someone else for your bad code

github.com

Post reply on HN
Print view View original

31–40 of 68 posts

Re: Git-blame-someone-else – Blame someone else for your bad code

#31

Post by wildlogic »

exDM69 wrote: post #9
andrewstuart2 wrote: post #7

And this is why I pgp sign all my commits. :-P

It's a bit worrying that GitHub will happily associate someone's face on a commit that they didn't write: https://github.com/jayphelps/git-blame-someone-else/commit/e... Perhaps GitHub should only do this for signed commits or commits to the author's own repository or something. GitHub also allows you to add anyone to a project without their consent (or has this changed?). This reminds me of the Facebook prank where…

I actually just noticed this yesterday when realizing that some commits to my personal repository on an unrelated-to-work project had my work account's username and picture, even though I used by personal account key. I guess this uses the global email and name settings, and github matches the picture. I got a bit worried that this stuff would start appearing on my work organization's timeline.

Re: Git-blame-someone-else – Blame someone else for your bad code

#32

Post by gbrown »

exDM69 wrote: post #9
andrewstuart2 wrote: post #7

And this is why I pgp sign all my commits. :-P

It's a bit worrying that GitHub will happily associate someone's face on a commit that they didn't write: https://github.com/jayphelps/git-blame-someone-else/commit/e... Perhaps GitHub should only do this for signed commits or commits to the author's own repository or something. GitHub also allows you to add anyone to a project without their consent (or has this changed?). This reminds me of the Facebook prank where…

Back when I was first learning to use git, I accidentally pushed a commit to my repo as the author of a set of dotfiles I'd cloned. It was a bit mortifying.

Re: Git-blame-someone-else – Blame someone else for your bad code

#33

Post by newday »

32bitkid wrote: post #24

Hell, I can do _all_ my work as somebody else with "git config user.name" and "git config user.email". If that's really a genuine concern, then a) you are working with a big bag of dicks and b) there are _way_ worse things that person can do with write access to the repository than masquerade as somebody else.

As stated in the project read me, it's just a joke project.

Re: Git-blame-someone-else – Blame someone else for your bad code

#34

Post by mschuster91 »

jakobegger wrote: post #26
facetube wrote: post #23

Earlier quoted context omitted.

Alternatively, they could provide some sort of on-page indication of a credentials/e-mail mismatch, i.e. detect and publicly report when the HTTPS/SSH credentials used for a `git push` aren't associated with a verified e-mail address matching the commit's `user.email`. I reported this issue a long time ago to their security team, and got a really condescending "we're a collaborative community, it's not a problem, you…

But isn't it somewhat reasonable that I push someone else's commit? Say I want to rewrite an old commit, and then force push that, then all the commits after the rewritten commit by other people would effectively be pushed by me. Or consider the common case where the public repository on Github is just a mirror of an official repository somewhere else -- then commits from a bunch of people would all be pushed by whoe…

> But isn't it somewhat reasonable that I push someone else's commit? Say I want to rewrite an old commit, and then force push that, then all the commits after the rewritten commit by other people would effectively be pushed by me.

Even worse: rebasing (what rewriting an old commit actually does) changes all SHA hashes of the following commits, thus breaking existing PGP signatures on the commits. There should be two signatures... one for the patch+comment, one for the history.

Re: Git-blame-someone-else – Blame someone else for your bad code

#35

Post by 32bitkid »

newday wrote: post #33
32bitkid wrote: post #24

Hell, I can do _all_ my work as somebody else with "git config user.name" and "git config user.email". If that's really a genuine concern, then a) you are working with a big bag of dicks and b) there are _way_ worse things that person can do with write access to the repository than masquerade as somebody else.

As stated in the project read me, it's just a joke project.

No, I get it, but even in this thread there is a higher-than-expected amount of hand-wringing.

Re: Git-blame-someone-else – Blame someone else for your bad code

#36

Post by facetube »

jakobegger wrote: post #26
facetube wrote: post #23

Earlier quoted context omitted.

Alternatively, they could provide some sort of on-page indication of a credentials/e-mail mismatch, i.e. detect and publicly report when the HTTPS/SSH credentials used for a `git push` aren't associated with a verified e-mail address matching the commit's `user.email`. I reported this issue a long time ago to their security team, and got a really condescending "we're a collaborative community, it's not a problem, you…

But isn't it somewhat reasonable that I push someone else's commit? Say I want to rewrite an old commit, and then force push that, then all the commits after the rewritten commit by other people would effectively be pushed by me. Or consider the common case where the public repository on Github is just a mirror of an official repository somewhere else -- then commits from a bunch of people would all be pushed by whoe…

Yeah, the "pushed by" indicator would be a great idea IMO.

Re: Git-blame-someone-else – Blame someone else for your bad code

#37

Post by dang »

LinuxBender wrote: post #17

This was also being discussed here [1] [1] https://news.ycombinator.com/item?id=11049993 Apparently it will be obvious to folks that this has occurred.

We moved the comments here from a later thread that hijacked "Show HN" (https://news.ycombinator.com/item?id=11053078). We also rolled back the clock on the current thread so it would go to the same position on the front page. It's still not really a fair swap because the other post has most of the points, but people will probably keep upvoting this one.

Re: Git-blame-someone-else – Blame someone else for your bad code

#39

Post by infinity0 »

gre wrote: post #27
infinity0 wrote: post #22

Earlier quoted context omitted.

> all following commits are preserved (hash doesn't change), but that's essentially impossible. Actually, you only need one brute-force (of the commit that you're changing); subsequent commits only refer to the parent hash, and here we're not changing the commit trees either. SHA1 is already considered broken, so git really should switch to SHA256 soon. This whole "sha1 commit hashes are not for security" argument is…

Why SHA-256 instead of SHA-3?

No particular reason, I just picked that as the default choice in my head. SHA-3 also works, just less widely implemented atm. (Still waiting for a sha3sum command in coreutils).

Re: Git-blame-someone-else – Blame someone else for your bad code

#40

Post by 0x4a42 »

SilasX wrote: post #28

Should probably use this moment to plug my (opposite) project, git-upstage, which lets you claim credit for someone else's work and backdate it so it looks like you did it first: https://github.com/SilasX/git-upstage

Much better. Love the hacker's twist. :)
Post reply on HN