Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git-blame-someone-else – Blame someone else for your bad code

github.com

Post reply on HN
Print view View original

41–50 of 68 posts

Re: Git-blame-someone-else – Blame someone else for your bad code

#41

Post by shurcooL »

infinity0 wrote: post #22
shurcooL wrote: post #19

(When I saw the title, I was wondering if this does something beyond the basic rebase, like trying to brute force a commit such that all following commits are preserved (hash doesn't change), but that's essentially impossible.) I'm tempted to make the observation that there's nothing here you can't already do with a git rebase -i and: GIT_COMMITTER_NAME=a GIT_COMMITTER_EMAIL=a@a.com GIT_COMMITTER_DATE=2006-01-02T15:0…

> all following commits are preserved (hash doesn't change), but that's essentially impossible. Actually, you only need one brute-force (of the commit that you're changing); subsequent commits only refer to the parent hash, and here we're not changing the commit trees either. SHA1 is already considered broken, so git really should switch to SHA256 soon. This whole "sha1 commit hashes are not for security" argument is…

Good point, only need to brute the commit being modified to have it match the original hash.

To get a brief sense of how hard it is to do, one can look at a sample project like gitbrute [0] that tries to brute force the first n letters of a commit hash. It took someone 30 mins to brute first 8 hex letters (of 40) on a MBP [1] with that.

[0] https://github.com/bradfitz/gitbrute

[1] https://github.com/bradfitz/deadbeef/commit/deadbeefa1a98280...

Re: Git-blame-someone-else – Blame someone else for your bad code

#43

Post by andrewray »

It's been my experience, especially in the startup scene where business requirements change often, that `git blame` rarely shows you what you want. Files get renamed, moved, re-indented, etc, frequently.

I wrote a tutorial on a more effective (at least for me) solution to find the true author of a change: http://blog.andrewray.me/a-better-git-blame/

Re: Git-blame-someone-else – Blame someone else for your bad code

#44

Post by chx »

andrewray wrote: post #43

It's been my experience, especially in the startup scene where business requirements change often, that `git blame` rarely shows you what you want. Files get renamed, moved, re-indented, etc, frequently. I wrote a tutorial on a more effective (at least for me) solution to find the true author of a change: http://blog.andrewray.me/a-better-git-blame/

I found http://1dan.org/git-blameall/ an incredibly useful tool for similar (not identical) purposes.

Re: Git-blame-someone-else – Blame someone else for your bad code

#45

Post by logicallee »

32bitkid wrote: post #35
newday wrote: post #33

Earlier quoted context omitted.

As stated in the project read me, it's just a joke project.

No, I get it, but even in this thread there is a higher-than-expected amount of hand-wringing.

I totally agree with 32bitkid's view of the other comments, makes a good point.

Re: Git-blame-someone-else – Blame someone else for your bad code

#46

Post by mrsuprawsm »

jakobegger wrote: post #26
facetube wrote: post #23

Earlier quoted context omitted.

Alternatively, they could provide some sort of on-page indication of a credentials/e-mail mismatch, i.e. detect and publicly report when the HTTPS/SSH credentials used for a `git push` aren't associated with a verified e-mail address matching the commit's `user.email`. I reported this issue a long time ago to their security team, and got a really condescending "we're a collaborative community, it's not a problem, you…

But isn't it somewhat reasonable that I push someone else's commit? Say I want to rewrite an old commit, and then force push that, then all the commits after the rewritten commit by other people would effectively be pushed by me. Or consider the common case where the public repository on Github is just a mirror of an official repository somewhere else -- then commits from a bunch of people would all be pushed by whoe…

They do have a "committed by" feature that appears when you cherry-pick someone else's commit to a branch.

It shows up as "Bob committed with Alice".

I've only noticed it showing up for cherry-picks, I'm unsure if that's the only place it's used.

Re: Git-blame-someone-else – Blame someone else for your bad code

#48

Post by stepvhen »

SilasX wrote: post #29
tinco wrote: post #14

Earlier quoted context omitted.

You mean besides developing and operating one of the best services on the web?

Best in what sense? Bitbucket does everything Github does, plus gives free private repos. GitHub is just more widely used.

Bitbucket crashes minimal browsers like Surf and github doesn't. So, in that regard, Github is better.

Re: Git-blame-someone-else – Blame someone else for your bad code

#49

Post by kmfrk »

mbrock wrote: post #12
andrewstuart2 wrote: post #10

Earlier quoted context omitted.

Agreed. It should be trivial for them to allow you to paste your pgp public key as you would your ssh public key, then place a nice little "verified" check mark next to commits that can be validated as having been signed with one of your associated private keys.

There are so many things that GitHub could easily do, but don't... Makes me wonder what they actually do.

If you can sell them on it as an important enterprise feature, they might implement something. :)

Re: Git-blame-someone-else – Blame someone else for your bad code

#50

Post by douche »

mbrock wrote: post #12
andrewstuart2 wrote: post #10

Earlier quoted context omitted.

Agreed. It should be trivial for them to allow you to paste your pgp public key as you would your ssh public key, then place a nice little "verified" check mark next to commits that can be validated as having been signed with one of your associated private keys.

There are so many things that GitHub could easily do, but don't... Makes me wonder what they actually do.

They are carrying the torch for rectifying social injustices, apparently. Oh, and selling out for the enterprise big-bucks.
Post reply on HN