Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to take credit for someone else's work on GitHub

repography.com

Post reply on HN
Print view View original

51–60 of 185 posts

Re: How to take credit for someone else's work on GitHub

#51

Post by peeters »

i_have_an_idea wrote: post #49
jokethrowaway wrote: post #48

Earlier quoted context omitted.

That's not the main complain, the issue is that GitHub is allowing users to claim emails even without verifying users are the owners of those emails.

how are they claiming emails?

> The problem is that GitHub makes this association even for unverified email addresses. In this case of course it really was Linus who made the first commit, but all it took was someone to add Linus's email address to their GitHub profile - without any verification - and now GitHub displays this person as the author instead.

Re: How to take credit for someone else's work on GitHub

#52

Post by np- »

gtirloni wrote: post #41
nynyny7 wrote: post #7

I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub. Not every contributor has kept their email address for over 20 years. Some…

> Still they want the commits to be associated with their current GitHub account Well, tough luck? I don't think it's that important. Just accept it as a fact of life: you lost access to your email account and can't verify you still own it (you don't, clearly). GitHub should just show the e-mail address when it can't associate that to an account, maybe show it's unverified and link to a help page explaining anyone co…

> Well, tough luck? I don't think it's that important. Just accept it as a fact of life: you lost access to your email account and can't verify you still own it (you don't, clearly).

This case might not be super important in the long run, but why does it have to be a fact of life? If a system doesn't work as its human operators intend, that's a system failure, not a human being failure.

Re: How to take credit for someone else's work on GitHub

#54

Post by i_have_an_idea »

peeters wrote: post #51
i_have_an_idea wrote: post #49

Earlier quoted context omitted.

how are they claiming emails?

> The problem is that GitHub makes this association even for unverified email addresses. In this case of course it really was Linus who made the first commit, but all it took was someone to add Linus's email address to their GitHub profile - without any verification - and now GitHub displays this person as the author instead.

I can also write on my own web site that my email address is linus@linuxfoundation.org. But I can't send or receive messages from it, so how exactly would I be claiming it?

Does GitHub allow you to impersonate Linus via email? No, it does not.

Re: How to take credit for someone else's work on GitHub

#55

Post by not2b »

elderlydoofus wrote: post #46
jamjamjamjamjam wrote: post #31

Earlier quoted context omitted.

The owner of huey does this. He closes PRs and submits the code himself

I had this happen on a small PR I submitted within the past year. I didn’t think anything of it at the time, but your comment led me to glancing through the past PRs and it’s comical how many are closed with a “thanks, I’ve committed an equivalent patch” comment. One the one hand, it’s his repo and he’s free to do whatever he wants. I actually admire how ruthless the maintainer is on closing issues, must be great for…

In many cases this is the right thing for a maintainer to do: a contributor produces a PR and a proposed patch, but often that patch doesn't solve the whole problem, or clashes with the coding style, or isn't very efficient, so the maintainer does their own fix, because that is faster than getting the contributor to produce a modified version.

Re: How to take credit for someone else's work on GitHub

#56

Post by not2b »

INTPenis wrote: post #32
fragmede wrote: post #13

Earlier quoted context omitted.

Because that's git's underlying mechanisms in action. In a distributed system, there's no centralized database to check things against, so there's no (distributed) way to do verification, leading to the issue described here. With the use of public key cryptography, there's a disconnected way to authenticate commit, and it works as well as public key cryptography does, but GitHub has all the levers needed to moved the…

Really? In this case isn't it just the Github web service that makes a decision on what to display? Sure if you clone the git repo you get the e-mail address, but then you also won't get any information about who the email belongs to on Github. I don't see how the design of Git affects this issue. This is simply one if clause away from being solved in Githubs frontend source code. Just check if email.verified: displa…

Github could easily add its own handling for historical addresses of well-known developers, and block others from masquerading as them, once abuses like this are reported.

Re: How to take credit for someone else's work on GitHub

#57

Post by anglinb »

I worked on the security team at GitHub, this was a long standing part of how git works. GitHub allows users to verify commits via GPG signatures to prove that they committed something but it doesn't work for proving a negative, that you did not commit something.

We got so many of these submissions which are clearly called out in the rules/scope, usually the people who don't read the rules don't find anything useful. ¯\_(ツ)_/¯

Re: How to take credit for someone else's work on GitHub

#58

Post by peeters »

i_have_an_idea wrote: post #54
peeters wrote: post #51

Earlier quoted context omitted.

> The problem is that GitHub makes this association even for unverified email addresses. In this case of course it really was Linus who made the first commit, but all it took was someone to add Linus's email address to their GitHub profile - without any verification - and now GitHub displays this person as the author instead.

I can also write on my own web site that my email address is linus@linuxfoundation.org. But I can't send or receive messages from it, so how exactly would I be claiming it? Does GitHub allow you to impersonate Linus via email? No, it does not.

I think you're fixated on the inverse of what this is. Imagine it's a true commit by Linus identified by his email address. This issue is when someone creates a GitHub profile with Linus' email address and by doing so, causes the GitHub UI to ascribe authorship of that commit to your user profile via your GitHub username and a link to your profile.

Re: How to take credit for someone else's work on GitHub

#59

Post by lowercased »

not2b wrote: post #55
elderlydoofus wrote: post #46

Earlier quoted context omitted.

I had this happen on a small PR I submitted within the past year. I didn’t think anything of it at the time, but your comment led me to glancing through the past PRs and it’s comical how many are closed with a “thanks, I’ve committed an equivalent patch” comment. One the one hand, it’s his repo and he’s free to do whatever he wants. I actually admire how ruthless the maintainer is on closing issues, must be great for…

In many cases this is the right thing for a maintainer to do: a contributor produces a PR and a proposed patch, but often that patch doesn't solve the whole problem, or clashes with the coding style, or isn't very efficient, so the maintainer does their own fix, because that is faster than getting the contributor to produce a modified version.

it can be, yes. there's chicken and egg issue of trying to help other people be more proficient in making those mods, learning about larger parts of the system, etc.

there's also the issue of being told "no, that's not a bug" or "no, WONTFIX", then... hours or days later... producing the same code patch as your own. Definitely a jerk move.

Re: How to take credit for someone else's work on GitHub

#60

Post by vgel »

anglinb wrote: post #57

I worked on the security team at GitHub, this was a long standing part of how git works. GitHub allows users to verify commits via GPG signatures to prove that they committed something but it doesn't work for proving a negative, that you did not commit something. We got so many of these submissions which are clearly called out in the rules/scope, usually the people who don't read the rules don't find anything useful.…

Obviously anyone can attach any email to any commit, but why does the frontend UI work like this:

    gh_profile = get_profile_with_email(commit_email)
and not this?

    gh_profile = get_profile_with_email(commit_email)
    if not gh_profile.has_verified_email_ownership(commit_email):
      return null
Post reply on HN