4 ms·

Really, this only becomes a problem when services like GitHub link the name up, making it look more legitimate than it is. If they enforced authentication as th

Really, this only becomes a problem when services like GitHub link the name up, making it look more legitimate than it is. If they enforced authentication as that user before providing the linking it would be better (perhaps allowing approval of the linking if posted by a different user). Currently it's trivial to make it look like any GitHub user is an actual committer to some sort of egregious or controversial project and users unaware of how GitHub maps this may easily be confused. EDIT: This gets even more disturbing when you realize that GitHub is a site many people list on their resumes and if this association applies from their user page too this could get very bad.

icebraining 11y ago
It doesn't seem to link in reverse to the user page; at least, I can't find anything on Linus' page related to this repo.
- _delirium 11y ago
  There's a Github help page explaining when commits show up in your profile (though worded as an answer for people wondering why one didn't): https://help.github.com/articles/why-are-my-contributions-not-showing-up-on-my-profile/ https://help.github.com/articles/why-are-my-contributions-no... The criteria not fulfilled for this one are that you have to have interacted with the repository on Github in some way. Any one of these criteria would suffice: you're a "collaborator" on the repository, you're a "member" of the organization the owns the repository, you have forked or starred the repository, you have opened a pull request or issue in the repository.
Maken 11y ago
Apparently Github doesn't list those faked commits in your profile. Which is anyway a problem because you could be "committing" to who knows what project project without being notified.
uxcn 11y ago
The simple solution seems to be github just distinguishing between signed and non-signed commits.
rakoo 11y ago
I disagree, the real problem here is people thinking that somehow any github repository can be a trusted source. If you work on Linux, you know that the one and only source of truth is the repo that comes from Linus himself, not anything coming from github.
- icebraining 11y ago
  Linus doesn't distribute anything himself; you can either have the copy hosted by Github, or the one hosted by a Californian nonprofit called the Linux Kernel Organization, Inc.

icebraining 11y ago

It doesn't seem to link in reverse to the user page; at least, I can't find anything on Linus' page related to this repo.

_delirium 11y ago
There's a Github help page explaining when commits show up in your profile (though worded as an answer for people wondering why one didn't): https://help.github.com/articles/why-are-my-contributions-not-showing-up-on-my-profile/ https://help.github.com/articles/why-are-my-contributions-no... The criteria not fulfilled for this one are that you have to have interacted with the repository on Github in some way. Any one of these criteria would suffice: you're a "collaborator" on the repository, you're a "member" of the organization the owns the repository, you have forked or starred the repository, you have opened a pull request or issue in the repository.

Maken 11y ago

Apparently Github doesn't list those faked commits in your profile. Which is anyway a problem because you could be "committing" to who knows what project project without being notified.

uxcn 11y ago

The simple solution seems to be github just distinguishing between signed and non-signed commits.

rakoo 11y ago

I disagree, the real problem here is people thinking that somehow any github repository can be a trusted source. If you work on Linux, you know that the one and only source of truth is the repo that comes from Linus himself, not anything coming from github.

icebraining 11y ago
Linus doesn't distribute anything himself; you can either have the copy hosted by Github, or the one hosted by a Californian nonprofit called the Linux Kernel Organization, Inc.