5 ms·
And this is why I pgp sign all my commits. :-P
by andrewstuart2 11y ago
And this is why I pgp sign all my commits. :-P
- exDM69 11y agoIt's a bit worrying that GitHub will happily associate someone's face on a commit that they didn't write: https://github.com/jayphelps/git-blame-someone-else/commit/e5cfe4bb2190a2ae406d5f0b8f49c32ac0f01cd7 https://github.com/jayphelps/git-blame-someone-else/commit/e... Perhaps GitHub should only do this for signed commits or commits to the author's own repository or something. GitHub also allows you to add anyone to a project without their consent (or has this changed?). This reminds me of the Facebook prank where someone added Mark Zuckerberg to a fake(?) pro-paedophile group.
- andrewstuart2 11y agoAgreed. It should be trivial for them to allow you to paste your pgp public key as you would your ssh public key, then place a nice little "verified" check mark next to commits that can be validated as having been signed with one of your associated private keys.
- mbrock 11y agoThere are so many things that GitHub could easily do, but don't... Makes me wonder what they actually do.
- tinco 11y agoYou mean besides developing and operating one of the best services on the web?
- baku-fr 11y agoWell maintaining software and infrastructure is one thing. But they also seem to lack features compared to the competition. They might want to quickly sort their management issues out and be more agressive feature-wise.
- swsieber 11y agoBest as in market share, but certainly not best by it's own merits. (ie there is better git management software)
- SilasX 11y agoBest in what sense? Bitbucket does everything Github does, plus gives free private repos. GitHub is just more widely used.
- stepvhen 11y agoBitbucket crashes minimal browsers like Surf and github doesn't. So, in that regard, Github is better.
- melloclello 11y agoBut Bitbucket is fricken awful though. I think I have an allergy to everything designed by Atlassian
- nqzero 11y agoi don't use bitbucket so can't comment if they provide this. but github has a nice hack allowing you to svn checkout a portion of a tree on a slow connection, this allows you to work on or inspect repos that are too large to git clone (one of the few major complaints i have with git itself)
- 746F7475 11y agoIs there anyway to search bitbucket? Can I link my profile to someone so they can see all my projects? I'm only dimly aware of bitbucket, but if these criteria are easily met then I might even consider changing over.
- mbrock 11y agoWell, yeah. It is a good service. They've contributed good stuff to Git core, too. I really wonder what they do. I have some complicated feelings about them, also, that has to do with them becoming the central hub for open source. Like, if the product itself were open source, it might be more obvious what they are working on. But I can't demand that kind of transparency... It would just be interesting to know. With almost 500 employees, what happens? I've never even worked at such a large company myself. Should GitHub users have some say in what the company builds? I mean, we're promoting them like hell, and the social network is a huge part of their value. I often wonder what well-funded large product companies do with all their manpower. Feature development doesn't seem to scale. Nor innovative design. GitHub's mobile layout is pretty crippled. I dunno. Just curious.
- kmfrk 11y agoIf you can sell them on it as an important enterprise feature, they might implement something. :)
- douche 11y agoThey are carrying the torch for rectifying social injustices, apparently. Oh, and selling out for the enterprise big-bucks.
- rmc 11y agoWorrying and potentially libelous. Some countries (e.g. UK) have strict libel law, and by using this you could get Github in trouble for publishing libelous material. Of course, this has always been possible with git.
- comex 11y agoThough since GitHub does not have an office in the UK and in the US is protected from foreign defamation judgements under the SPEECH Act, it probably doesn't have much to worry about.
- rmc 11y agoJust wait until they want to take advantage of Ireland's favourable tax regime. Ireland also has strict libel/defamation laws.
- facetube 11y agoAlternatively, they could provide some sort of on-page indication of a credentials/e-mail mismatch, i.e. detect and publicly report when the HTTPS/SSH credentials used for a `git push` aren't associated with a verified e-mail address matching the commit's `user.email`. I reported this issue a long time ago to their security team, and got a really condescending "we're a collaborative community, it's not a problem, you obviously don't understand" type of response. Pretty frustrating.
- jakobegger 11y agoBut isn't it somewhat reasonable that I push someone else's commit? Say I want to rewrite an old commit, and then force push that, then all the commits after the rewritten commit by other people would effectively be pushed by me. Or consider the common case where the public repository on Github is just a mirror of an official repository somewhere else -- then commits from a bunch of people would all be pushed by whoever is responsible for keeping the repos in sync. But maybe Github could just add some kind of a "pushed by" label that identifies the Github user who pushed the commit?
- mschuster91 11y ago> But isn't it somewhat reasonable that I push someone else's commit? Say I want to rewrite an old commit, and then force push that, then all the commits after the rewritten commit by other people would effectively be pushed by me. Even worse: rebasing (what rewriting an old commit actually does) changes all SHA hashes of the following commits, thus breaking existing PGP signatures on the commits. There should be two signatures... one for the patch+comment, one for the history.
- facetube 11y agoYeah, the "pushed by" indicator would be a great idea IMO.
- mrsuprawsm 11y agoThey do have a "committed by" feature that appears when you cherry-pick someone else's commit to a branch. It shows up as "Bob committed with Alice". I've only noticed it showing up for cherry-picks, I'm unsure if that's the only place it's used.
- wildlogic 11y agoI actually just noticed this yesterday when realizing that some commits to my personal repository on an unrelated-to-work project had my work account's username and picture, even though I used by personal account key. I guess this uses the global email and name settings, and github matches the picture. I got a bit worried that this stuff would start appearing on my work organization's timeline.
- gbrown 11y agoBack when I was first learning to use git, I accidentally pushed a commit to my repo as the author of a set of dotfiles I'd cloned. It was a bit mortifying.
- ksenzee 11y agoOne of my coworkers did the same thing years ago, and he still takes flak for it.
- drdeca 11y agoI'm actually surprised that git doesn't sign commits by default. (i.e. I had assumed that it did.) It already has the keys set up and such.
- superuser2 11y agoNo it doesn't. Git works independently of SSH.
- drdeca 11y agoOh. Oops. Thanks for the correction.