Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds did not commit this

github.com

Post reply on HN
Print view View original

51–60 of 198 posts

Re: Linus Torvalds did not commit this

#51

Post by nolok »

brillenfux wrote: post #47

Another example of why email addresses cannot serve as "identities" like so many people, somehow magically, assume. If you know it, everything about email and its protocols would make you assume the exact opposite. Now PGP signatures on the other hand … but hey, nobody wants those, right?! Far too complicated! /rant

This has nothing to do with emails serving as identities and everything to do with not believing user's input without verification.

If github was linking to user's profile based on first/last name rather than email the issue would be the exact same.

Re: Linus Torvalds did not commit this

#53

Post by yxhuvud »

aikah wrote: post #16

It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.

It is really not possible for github to track the origin of commits.

For example, consider a fork. If you pull some commits from the original and then push them to your fork then that would look just like this.

The only thing I can think of is that it may be possible to track commits if everyone would sign them as they were created, but that would require all users to change, so I don't see how that can happen.

Re: Linus Torvalds did not commit this

#54

Post by _delirium »

icebraining wrote: post #31
ultramancool wrote: post #12

Earlier quoted context omitted.

Really, this only becomes a problem when services like GitHub link the name up, making it look more legitimate than it is. If they enforced authentication as that user before providing the linking it would be better (perhaps allowing approval of the linking if posted by a different user). Currently it's trivial to make it look like any GitHub user is an actual committer to some sort of egregious or controversial proj…

It doesn't seem to link in reverse to the user page; at least, I can't find anything on Linus' page related to this repo.

There's a Github help page explaining when commits show up in your profile (though worded as an answer for people wondering why one didn't): https://help.github.com/articles/why-are-my-contributions-no...

The criteria not fulfilled for this one are that you have to have interacted with the repository on Github in some way. Any one of these criteria would suffice: you're a "collaborator" on the repository, you're a "member" of the organization the owns the repository, you have forked or starred the repository, you have opened a pull request or issue in the repository.

Re: Linus Torvalds did not commit this

#55

Post by uxcn »

ultramancool wrote: post #12
nailer wrote: post #4

Earlier quoted context omitted.

I guess the real uptake is that commits should really be signed by default (eg, by encouraging signing in the tools & ecosystem).

Really, this only becomes a problem when services like GitHub link the name up, making it look more legitimate than it is. If they enforced authentication as that user before providing the linking it would be better (perhaps allowing approval of the linking if posted by a different user). Currently it's trivial to make it look like any GitHub user is an actual committer to some sort of egregious or controversial proj…

The simple solution seems to be github just distinguishing between signed and non-signed commits.

Re: Linus Torvalds did not commit this

#57

Post by bronson »

seba_dos1 wrote: post #34
ionforce wrote: post #23

Earlier quoted context omitted.

What's wrong with having a clean commit history? I think it's something people take too lightly.

Nothing. Just like there's nothing wrong with not having it clean.

Depends on the project. If I ran the Linux kernel, I'd insist on clear commits too.

Re: Linus Torvalds did not commit this

#58

Post by arihant »

So this is a Github feature, which might be useful in some cases, I get that. The good news here is that it only goes one level deep, i.e., it does not automagically show up on Linus' account in any way.

This also has been an issue with Git for a long time. In any repository, you can see the email of the person who committed it, and it can be spoofed, because there are no checks. So while here we see it linked to Linus' account, the problem with plausible identity theft has always been a part of Git.

There are ways to solve it. Git can just put "" next to non PGP commits. Github can also put "" when commits are made outside of Github realm (not using their keys of https auth), or are unsigned.

Just be careful while merging pull requests, which one has to anyway. And because one has to, these issues never seem to get a fix.

Re: Linus Torvalds did not commit this

#60

Post by wcummings »

rabbyte wrote: post #9
wcummings wrote: post #3

I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.

While it's probably well known from a command line perspective, I doubt it's well known from a web service (GitHub) perspective. I have a healthy distrust of git logs but trusting a photo and username on GitHub is a pattern reinforced by every other social app.

I've seen this demonstrated on github before w/ defunkt's account/email
Post reply on HN