4 ms·

It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate ot

by aikah 11y ago

It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.

yxhuvud 11y ago
It is really not possible for github to track the origin of commits. For example, consider a fork. If you pull some commits from the original and then push them to your fork then that would look just like this. The only thing I can think of is that it may be possible to track commits if everyone would sign them as they were created, but that would require all users to change, so I don't see how that can happen.
- andrewstuart2 11y ago
  If a user could upload their public GPG key to their account (as they can their public SSH key), GitHub could easily verify signed commits, which git itself allows with `git commit --gpg-sign[=<keyid>] ...`. It would be trivial for them to shell out to `git verify-commit <commit>` in order to verify that the claimed originator has signed his commits with a key tracked by github (by email address, which can belong to only one github user).
- jerf 11y ago
  A checkbox that requires push commits to be signed (you don't have to sign each one, but the top level of any push would have to be signed) would be nice. So would any indication that commits are signed in the GitHub UI. I've started signing my commits to GitHub, but verifying even that a signature is present (let alone correct) requires you to clone the repo and investigate it with commands you'd probably have to Google, as far as I know. No UI visibility whatsoever.
- icebraining 11y ago
  An idea that doesn't require signing is tracking commits internally. If you push a commit made by you, Github can tag that as "trusted" (since you, the GH user, are vouching for your own commits). Then anyone who pulls them into their repo (even offline) and pushes it to their GH account would still have those commits tagged, since GH could match the hash with the ones it already knew about. For the most part, this would solve the problem, since people usually upload the commits to their own GH fork and then issue a PR.
- facetube 11y ago
  How about just showing who actually made the HTTPS or SSH connection to Github to push the changeset?
arihant 11y ago
It is a Git issue. In any Git repo, you can spoof anybody's name or email. All Github did here is show his Github account instead of e-mail. That doesn't really make it worse.
- cbd1984 11y ago
  It being a "Git issue" implies it should be fixed by modifying the Git software. I'm not entirely sure how someone would go about doing that, assuming you can't assume that each machine generating contributions will only be used by a single contributor and never shared. (Tokens such as thumb drives can be stolen and copied, too, and an application can't be sure it's reading off a thumb drive anyway.)
  - arihant 11y ago
    By appending "unverified" and "unsigned" after the email addresses? Just like email. This problem has been solved long ago, there is no reason why Git can't fix this. It already has PGP signatures, there is no reason to not add verification layer.
    - simoncion 11y ago
      > [Git] already has PGP signatures, there is no reason to not add verification layer. It already does. man 1 git-verify-commit man 1 git-verify-tag This is a Github problem.
      - arihant 11y ago
        You can run those commands by cloning that repo. The issue here is that emails can still be spoofed while looking at the commit, without running the command. Why do you think that seeing a username on Github is any different that seeing an unverified email in any other hosted Git repo? You need to git-verify in both cases. It is your own misunderstanding that seeing a username on Github implies it's verified. It's not. Just like looking at email is not on Git.

by aikah 11y ago

It's a github 'social' issue , not really a git issue. It might also be a legal issue (identity theft). And i'm a bit surprised github let people impersonate others through their 'social' features.

yxhuvud 11y ago

It is really not possible for github to track the origin of commits. For example, consider a fork. If you pull some commits from the original and then push them to your fork then that would look just like this. The only thing I can think of is that it may be possible to track commits if everyone would sign them as they were created, but that would require all users to change, so I don't see how that can happen.

andrewstuart2 11y ago
If a user could upload their public GPG key to their account (as they can their public SSH key), GitHub could easily verify signed commits, which git itself allows with `git commit --gpg-sign[=<keyid>] ...`. It would be trivial for them to shell out to `git verify-commit <commit>` in order to verify that the claimed originator has signed his commits with a key tracked by github (by email address, which can belong to only one github user).
jerf 11y ago
A checkbox that requires push commits to be signed (you don't have to sign each one, but the top level of any push would have to be signed) would be nice. So would any indication that commits are signed in the GitHub UI. I've started signing my commits to GitHub, but verifying even that a signature is present (let alone correct) requires you to clone the repo and investigate it with commands you'd probably have to Google, as far as I know. No UI visibility whatsoever.
icebraining 11y ago
An idea that doesn't require signing is tracking commits internally. If you push a commit made by you, Github can tag that as "trusted" (since you, the GH user, are vouching for your own commits). Then anyone who pulls them into their repo (even offline) and pushes it to their GH account would still have those commits tagged, since GH could match the hash with the ones it already knew about. For the most part, this would solve the problem, since people usually upload the commits to their own GH fork and then issue a PR.
facetube 11y ago
How about just showing who actually made the HTTPS or SSH connection to Github to push the changeset?

arihant 11y ago

It is a Git issue. In any Git repo, you can spoof anybody's name or email. All Github did here is show his Github account instead of e-mail. That doesn't really make it worse.

cbd1984 11y ago
It being a "Git issue" implies it should be fixed by modifying the Git software. I'm not entirely sure how someone would go about doing that, assuming you can't assume that each machine generating contributions will only be used by a single contributor and never shared. (Tokens such as thumb drives can be stolen and copied, too, and an application can't be sure it's reading off a thumb drive anyway.)
- arihant 11y ago
  By appending "unverified" and "unsigned" after the email addresses? Just like email. This problem has been solved long ago, there is no reason why Git can't fix this. It already has PGP signatures, there is no reason to not add verification layer.
  - simoncion 11y ago
    > [Git] already has PGP signatures, there is no reason to not add verification layer. It already does. man 1 git-verify-commit man 1 git-verify-tag This is a Github problem.
    - arihant 11y ago
      You can run those commands by cloning that repo. The issue here is that emails can still be spoofed while looking at the commit, without running the command. Why do you think that seeing a username on Github is any different that seeing an unverified email in any other hosted Git repo? You need to git-verify in both cases. It is your own misunderstanding that seeing a username on Github implies it's verified. It's not. Just like looking at email is not on Git.