How to take credit for someone else's work on GitHub
repography.com
How to take credit for someone else's work on GitHub
1–10 of 185 posts
Re: How to take credit for someone else's work on GitHub
#2Why does the email address hijacking only work/show up for the first commit?
Re: How to take credit for someone else's work on GitHub
#3GitHub’s response is pretty surprising. How can anyone think this is expected? Having to follow Git’s commit message emails makes sense and indeed anybody can use any email they want to make a commit. But then for GitHub to make the connection between (unverified) commit emails and (unverified) GitHub.com accounts is the issue for me. Since they can’t verify the commit email belongs to a GitHub account, why show that as though it were true?
Re: How to take credit for someone else's work on GitHub
#4Why does the email address hijacking only work/show up for the first commit?
It is not merely for the first commit, here, the first commits are used as a proof of concept since they are large repostories known to everyone. You can try it yourself, by changing your email to something like Linus' email in your git config, and then trying to commit code. GitHub will automatically show Linus' profile.
Re: How to take credit for someone else's work on GitHub
#5GitHub’s response is pretty surprising. How can anyone think this is expected? Having to follow Git’s commit message emails makes sense and indeed anybody can use any email they want to make a commit. But then for GitHub to make the connection between (unverified) commit emails and (unverified) GitHub.com accounts is the issue for me. Since they can’t verify the commit email belongs to a GitHub account, why show that…
And if "the proper way to verify committer identity is, as per GitHub's response, a cryptographic signature", Github is certainly not pushing this.
If the only real security around attribution is "a cryptographic signature", GitHub could do a lot better in pushing this, making it essential part of the signup or "getting started" and such.
Re: How to take credit for someone else's work on GitHub
#6It seems that one proper solution could be:
1 - Don't associate the commit to an account if the email is unverified, obviously
2 - If someone tries to "forge" ownership by pushing a commit with an e-mail that doesn't belong to the GitHub account being used to push, a "unverified" warning should be added to the commit and manually claimed by the account owning said e-mail for its status to change.
Re: How to take credit for someone else's work on GitHub
#7I do see a point in it working like it does, though. I'm one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project's history going back to the very first commit into git and GitHub.
Not every contributor has kept their email address for over 20 years. Some don't have access to the old addresses they once used for commits. Still they want the commits to be associated with their current GitHub account; even if it's just for statistics and "bragging rights".
If GitHub required email address verification, how would this be done?
EDIT: To be clear: With "working like it does" I'm referring to the possibility to add unverified email addresses to your account and have commits attributed to you.
Re: How to take credit for someone else's work on GitHub
#8Arpad, your site looks like this - https://i.imgur.com/jj9Uxbl.png
Not just the linked page, the homepage too. All but illegible. That's in a recent Firefox on Windows. Just FYI.
Re: How to take credit for someone else's work on GitHub
#9[deleted]
Re: How to take credit for someone else's work on GitHub
#10This is just a fact of how attribution works in Git. It's not GitHub's responsibility to figure out exactly who should be given credit for which commit, they're just a viewer on top of Git commits.
Imagine you did some work at some workplace years ago, and you want credit for it. You don't have access to that email anymore, but you'd still like to have the credit and have it link to your account. That's the usecase.