Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I configure my Git identities

benji.dog

Post reply on HN
Print view View original

71–80 of 113 posts

Re: How I configure my Git identities

#71

Post by est »

montroser wrote: post #50

I used to work at a startup with a character who would set his identity to be random fairytale-sounding nonsense, changing every day. So his commits on Monday would be attributed to Mr. Bunnymann, and Tuesday would be Doctor Funtime, etc. It was super unhelpful when trying to do version control forensics. But if I'm being generous, I think maybe he was trying to remind everyone that anyone can put anything in their i…

git has built in support to separate author and committer I believe he/she is just changing the author property.

Re: How I configure my Git identities

#73

Post by necovek »

kroltan wrote: post #67
necovek wrote: post #60

Earlier quoted context omitted.

Using a "personal machine for work" is a very wide gamut of situations (eg. at one remote-first company, we were expected to provide our own laptops, and got extra money every 2-3 years to buy a new one, but they were always our "personal" laptops even if the company contributed to paying them off; or what if you are a temporary contractor; or...). Care to elaborate in what circumstances is it a problem and why? Edit…

- Endpoint monitoring software may compromise more than it strictly needs to; - If you're a contractor, risk of leaking other clients' assets (running `tree` in the wrong folder while screensharing or more subtle variations); - Shredder policy, done with the work = destroy hardware (though I don't think companies with shredder policy would incentivise personal laptops, you never know)

If it's a personal laptop, I would assume there is no "endpoint monitoring software" installed.

When it comes to "assets", companies make a big fuss about leaking them, but in reality, it's totally irrelevant. I.e. witness Windows OS source code being leaked: Microsoft wasn't affected at all. Leaking short/mid-term plans would probably have a bigger effect (abuse on the stock market, beating a competitor to the market on their big bet...).

Re: How I configure my Git identities

#74

Post by lijok »

necovek wrote: post #60
lijok wrote: post #48

I always strongly advise consultants to use a separate machine for work, or at the very least a separate OS user. You’re risking putting yourself in a whole lot of trouble by using a personal machine for work.

Using a "personal machine for work" is a very wide gamut of situations (eg. at one remote-first company, we were expected to provide our own laptops, and got extra money every 2-3 years to buy a new one, but they were always our "personal" laptops even if the company contributed to paying them off; or what if you are a temporary contractor; or...). Care to elaborate in what circumstances is it a problem and why? Edit…

Personal machine as in a machine that you use for anything other than work for that particular client.

The same goes for putting anything personal on a company issued device, such as signing into your private email.

It is a problem in all circumstances. The problems may not always manifest, but if they do, you’ll be in deep trouble.

Problems range from the mild; company has mandatory tooling that takes control of your machine. To the extreme; offices get raided and equipment seized indiscriminately.

General assertions are fine. The exercise of whether to follow them up with research is left as an exercise to the reader.

Re: How I configure my Git identities

#75

Post by lijok »

necovek wrote: post #73
kroltan wrote: post #67

Earlier quoted context omitted.

- Endpoint monitoring software may compromise more than it strictly needs to; - If you're a contractor, risk of leaking other clients' assets (running `tree` in the wrong folder while screensharing or more subtle variations); - Shredder policy, done with the work = destroy hardware (though I don't think companies with shredder policy would incentivise personal laptops, you never know)

If it's a personal laptop, I would assume there is no "endpoint monitoring software" installed. When it comes to "assets", companies make a big fuss about leaking them, but in reality, it's totally irrelevant. I.e. witness Windows OS source code being leaked: Microsoft wasn't affected at all. Leaking short/mid-term plans would probably have a bigger effect (abuse on the stock market, beating a competitor to the marke…

> When it comes to "assets", companies make a big fuss about leaking them, but in reality, it's totally irrelevant

There’s no milder way to put this; you’re delusional.

Re: How I configure my Git identities

#76

Post by redak »

computerfriend wrote: post #30

This is a nice trick. But if you: * use a dedicated work machine and * also want to version control your dotfiles (including ~/.config/git/) and * don't want to leak your work repository organisation via your dotfiles, you can instead add something like [include] path = work.gitconfig which will override any settings above it and also fail gracefully/silently if work.gitconfig does not exist.

What would work.gitconfig include in this case?

Re: How I configure my Git identities

#77

Post by kreetx »

flumpcakes wrote: post #52
er453r wrote: post #42

One even-better approach IMHO Just keep a .gitconfig in your HOME with aliases for your identities. Then just after initializing/cloning the repo do git config-company or git config-personal er453r@r7:~$ cat ~/.gitconfig [user] useConfigOnly = true [alias] config-personal = !echo CONFIG-PERSONAL && \ git config --local user.email 'personal@email.com' && \ git config --local user.name 'personal' && \ git config --loca…

How would you do the initial clone without the correct ssh config to begin with? I think the benefit of the article's method is that any clone from their org will just work .

I have something like the parent suggests and yes, the article's idea is better because you don't need to do anything manual nor remember to run your own command at all.

Re: How I configure my Git identities

#78

Post by necovek »

montroser wrote: post #50

I used to work at a startup with a character who would set his identity to be random fairytale-sounding nonsense, changing every day. So his commits on Monday would be attributed to Mr. Bunnymann, and Tuesday would be Doctor Funtime, etc. It was super unhelpful when trying to do version control forensics. But if I'm being generous, I think maybe he was trying to remind everyone that anyone can put anything in their i…

If yours was a "blameless culture", when you did "version control forensics", you didn't really care about who did it, but when it happened and around what other changes (to understand the broader context)? Right? (Though obviously, it helps to know who did something so you can ask them directly if they remember more details, or so you know what to expect when it comes to style and expertise :)

Anyway, if you simply[1] require commits to be signed with GPG, and enlist what GPG identities are acceptable, you are pretty much set (and you can instead rely on the signature instead of the author/committer metadata to identify the actual author).

[1] "Simply" and GPG signing don't always go hand-in-hand, I admit.

Re: How I configure my Git identities

#79

Post by sshine »

necovek wrote: post #60
lijok wrote: post #48

I always strongly advise consultants to use a separate machine for work, or at the very least a separate OS user. You’re risking putting yourself in a whole lot of trouble by using a personal machine for work.

Using a "personal machine for work" is a very wide gamut of situations (eg. at one remote-first company, we were expected to provide our own laptops, and got extra money every 2-3 years to buy a new one, but they were always our "personal" laptops even if the company contributed to paying them off; or what if you are a temporary contractor; or...). Care to elaborate in what circumstances is it a problem and why? Edit…

> Care to elaborate in what circumstances is using a "personal machine for work" a problem and why?

When you stop working for an employer/customer and you are legally required to purge all files.

Having everything work-related on a dedicated machine makes purging all files very easy.

Not having everything work-related on a dedicated machine makes purging all files questionable.

Post reply on HN