Linus Torvalds did not commit this

#1

Post by daenz » Tue, Aug 04, 2015, 7:15 PM UTC

Linus Torvalds did not commit this
github.com

Re: Linus Torvalds did not commit this

#2

Post by seba_dos1 » Tue, Aug 04, 2015, 7:25 PM UTC

Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables.

I guess it's worth noting here that you can sign your commits with GPG: https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work

Re: Linus Torvalds did not commit this

#3

Post by wcummings » Tue, Aug 04, 2015, 7:25 PM UTC

I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.

Re: Linus Torvalds did not commit this

#4

Post by nailer » Tue, Aug 04, 2015, 7:27 PM UTC

seba_dos1 wrote: post #2

Kinda hard to not come up with it when setting up your credentials is the first thing git wants you to do before you can commit anything. BTW. You can also overwrite them by command line switches per commit instead of setting environment variables. I guess it's worth noting here that you can sign your commits with GPG: https://git-scm.com/book/tr/v2/Git-Tools-Signing-Your-Work

I guess the real uptake is that commits should really be signed by default (eg, by encouraging signing in the tools & ecosystem).

Re: Linus Torvalds did not commit this

#5

Post by zeeshanm » Tue, Aug 04, 2015, 7:31 PM UTC

So, this actually works:

https://github.com/zixan/uberfareestimator/commit/b4c5a16408...

Re: Linus Torvalds did not commit this

#6

Post by mmcclure » Tue, Aug 04, 2015, 7:31 PM UTC

TBH we "exploit" this when accepting PRs for an open source project I work on. It's not really feasible for us to expect / force each PR author to have a clean commit history, so we basically do some squashing, then commit the "single" change as the original author before merging.

Re: Linus Torvalds did not commit this

#7

Post by stephengillie » Tue, Aug 04, 2015, 7:33 PM UTC

wcummings wrote: post #3

I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.

I feel as though a GIT demo somewhere has already shown me how to impersonate Linus or anyone else.

Re: Linus Torvalds did not commit this

#8

Post by wcummings » Tue, Aug 04, 2015, 7:34 PM UTC

stephengillie wrote: post #7

wcummings wrote: post #3

I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.

I feel as though a GIT demo somewhere has already shown me how to impersonate Linus or anyone else.

Yeah, I've definitely seen something very similar, as well.

Re: Linus Torvalds did not commit this

#9

Post by rabbyte » Tue, Aug 04, 2015, 7:36 PM UTC

wcummings wrote: post #3

I think this is pretty well known. You could always sign your commits if you're really worried about someone sticking your email address in their git config.

While it's probably well known from a command line perspective, I doubt it's well known from a web service (GitHub) perspective. I have a healthy distrust of git logs but trusting a photo and username on GitHub is a pattern reinforced by every other social app.

Re: Linus Torvalds did not commit this

#10

Post by johannes1234321 » Tue, Aug 04, 2015, 7:37 PM UTC

mmcclure wrote: post #6

TBH we "exploit" this when accepting PRs for an open source project I work on. It's not really feasible for us to expect / force each PR author to have a clean commit history, so we basically do some squashing, then commit the "single" change as the original author before merging.

So, when submitting to your project it can happen that I'm afterwards blamed for things I didn't do? (Or praised)