Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to take credit for someone else's work on GitHub

repography.com

Post reply on HN
Print view View original

41–50 of 185 posts

Re: How to take credit for someone else's work on GitHub

#41

Post by gtirloni »

nynyny7 wrote: post #7

I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…

> Still they want the commits to be associated with their current GitHub account

Well, tough luck? I don't think it's that important. Just accept it as a fact of life: you lost access to your email account and can't verify you still own it (you don't, clearly).

GitHub should just show the e-mail address when it can't associate that to an account, maybe show it's unverified and link to a help page explaining anyone could have faked that in the commit. I don't understand why they care so much to put a face (the GH account) on the commit when the address is not verified.

Re: How to take credit for someone else's work on GitHub

#42

Post by Kwpolska »

nynyny7 wrote: post #38
arraypad wrote: post #27

Earlier quoted context omitted.

In this case I think you could use a .mailmap [1] in the repo to associate the old email addresses with current, verified addresses. [1] https://git-scm.com/docs/gitmailmap

Interesting. One never stops learning new git features... However, while this works for git (i.e., maps old address to new address in "git log" for example), GitHub does not seem to honor this file.

GitHub bases the association of commits to user accounts on the list of e-mail addresses configured in the user’s profile: https://github.com/settings/emails

Re: How to take credit for someone else's work on GitHub

#43

Post by myroon5 »

I have used emails in the past I can no longer verify, so I see a use case for linking unverified emails to profiles if there's only one profile claiming the email address

However, if another profile verified that email address, it definitely shouldn't link to another profile that hasn't verified

Re: How to take credit for someone else's work on GitHub

#45

Post by adewinter »

denysvitali wrote: post #33

I noticed that arraypad is really trying to push his repography project. Whilst this is not a bad thing, it seems like he is using the blog posts as an excuse to push more his project. I don't mind that much, but I think I've seen these posts hitting the front page quite a lot already - it's a good strategy but it could be maybe against the guidelines: > Please don't use HN primarily for promotion. It's ok to post yo…

A grand total of 7 submissions to blog posts over the course of a month is probably fine.

Re: How to take credit for someone else's work on GitHub

#46

Post by elderlydoofus »

jamjamjamjamjam wrote: post #31
lowercased wrote: post #23

I thought this might be something different. Have seen this happen multiple times over the years - even once just last week. Colleague files an issue with a PR. Project owners close it, say 'no, not a bug', then... commits the same thing themselves as "fixed!". Saw this years before in cvs/svn, and... at least in the GH world there's some evidence of the original PR author having done the work in the first place (vs…

The owner of huey does this. He closes PRs and submits the code himself

I had this happen on a small PR I submitted within the past year. I didn’t think anything of it at the time, but your comment led me to glancing through the past PRs and it’s comical how many are closed with a “thanks, I’ve committed an equivalent patch” comment.

One the one hand, it’s his repo and he’s free to do whatever he wants. I actually admire how ruthless the maintainer is on closing issues, must be great for staving off OSS burnout.

On the other hand, I don’t love how antagonistic it is to outside contributors. Litestream[0] is an example of open source-closed contributions, but at least it’s upfront about that in the README. (And the policy has actually changed to open for bug fixes.) I would open an issue/PR on Huey suggesting adding a similar disclaimer, but it’d probably be closed, ha.

[0] https://github.com/benbjohnson/litestream#contribution-polic...

Re: How to take credit for someone else's work on GitHub

#47

Post by peeters »

i_have_an_idea wrote: post #44

Quoted post unavailable.

I think you're missing the point of what the author is asking. Showing the email address from the commit is one thing (and the author is fine with showing that). That's the limit to what git gives you. Associating that email address to a GitHub user profile which never verified ownership of that email address is a GitHub UX decision, having nothing to do with git. That's what the author is saying is a security flaw.

That said, clearly users shouldn't be ascribing any level of certainty to commits that point to a GitHub profile even if the email address is verified, since AFAIK nothing is stopping the inverse attack, i.e. having someone else take credit for your work. Which is arguably more exploitable.

Re: How to take credit for someone else's work on GitHub

#49

Post by i_have_an_idea »

jokethrowaway wrote: post #48
i_have_an_idea wrote: post #44

Quoted post unavailable.

That's not the main complain, the issue is that GitHub is allowing users to claim emails even without verifying users are the owners of those emails.

how are they claiming emails?

Re: How to take credit for someone else's work on GitHub

#50

Post by devrand »

kevincox wrote: post #29
_jal wrote: post #28

Earlier quoted context omitted.

Really? GH Enterprise definitely verifies GPG.

It verifies the signature but I was able to just add a public key that I found online to my account.

Will Github verify a commit associated with a GH account via an unverified e-mail address?

If so then it's probably fine since you would have to demonstrate ownership of an e-mail address that was contained in the signed payload, or you would have to be able to sign payloads yourself (i.e. you have the private key).

Post reply on HN