5 ms·

GitHub's email correlation for authorship

43 points by timf 16y ago

timf 16y ago
This was just me verifying what I saw, that if you push commits to GitHub, it correlates the email address of authors introducing commits elsewhere. You can make it look like anyone you want is contributing patches, the avatar shows up, etc. This example commit does NOT show up in dhh's timeline, though. I am not going to start requiring PGP signing for my projects, they are not big enough to miss something fishy. This was just something I hadn't considered, it is probably an obvious issue to many already.
- wwortiz 16y ago
  I would hope people didn't blindly accept patches off of merit anyways, or is there another problem I am missing? Edit: not to say this shouldn't be fixed I am curious if this implies anything else that I may be missing.
  - clemesha 16y ago
    No patch has been accepted (unless I mis-understood what you are saying). In fact, if it's not totally obvious to everyone that timf is the one that committed the latest commit, then this demonstration is noteworthy.
    - wwortiz 16y ago
      I was simply stating that patches shouldn't be accepted just because a high profile person submitted it (which this could possible be used to spoof for malicious intent). As for the second part I was wondering if this had any other implications such as committing to someone else repo or if it is just masking identities with another users.
- lenni 16y ago
  Would you care to elaborate a little? I only understand it partially. So, you aren't 'dhh' but you commited using his email address and it showed up as him?
  - clemesha 16y ago
    You have it correct. What you say in your second sentence is exactly the issue. If this is "actually" a big issue or not is another question.
    - technoweenie 16y ago
      Sure, all it does is links the commit to a github login. It doesn't somehow give you access to any data that's not yours. You've just discovered another way to post spam.
  - petercooper 16y ago
    It's on a par with using a forged From header over SMTP. You can send e-mail as pretty much anyone. (Though technologies like SPF are helping clamp down on this.) "Joe jobbing" is when spammers use real e-mail addresses in their From headers so that that person gets the flak. In a round about way, this is the same for patches/commits :-)
  - jackowayed 16y ago
    He changed his git config so that user.email was david@loudthinking.com (The email DHH lists on GitHub). GitHub then automatically says "oh, this is by david@loudthinking.com, so let's put his avatar there and link to his profile as the author." Changing the config is as simple as git config user.email "david@loudthinking.com" And you can add a --global flag if you want that to be the default for all repos instead of just the one you're on. Edit: There's also some way to do it with a --author= flag when you commit.
- rtomayko 16y ago
  That's mostly correct. We use the email addresses provided in the commit Author and Committer fields and correlate them with the email addresses associated with GitHub user accounts. The commit Author/Committer email addresses are also used to fetch gravatar images even when no GitHub user account exists for the email. It's trivial to spoof these fields using the --author argument to git-commit(1), by setting the GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL environment variables, or by setting a different name/email using git-config(1).
  - timf 16y ago
    Thanks. So it didn't cross my mind that this was some huge security flaw, I would have reported something like that privately. I hope starting this discussion does not cause any unecessary confusion. GitHub rocks, it has really changed our contributor attitudes. I am a happy, paying customer (another account) and just really hope you guys are around a long time!
    - rtomayko 16y ago
      > GitHub rocks, it has really changed the contributor attitudes for my main project, I am a paying customer (another account) Thanks! > and just really hope you guys are around a long time! We'll be here. It's a profitable business with a straightforward model and we intend to keep it that way.
adbge 16y ago
Might be an issue in that it could be used to damage someone's reputation by spoofing their avatar/etc and then trying to push malicious commits. That's what occurs to me at first glance, anyways.
petercooper 16y ago
We could call this "joe patching," named after the similar issue of "joe jobbing." :-)
JimBastard 16y ago
github has several security holes....this is nothing compared to what is live right now... here's a screenshot from some of my previous github exploits... http://i.imgur.com/irL01.png http://i.imgur.com/irL01.png
JamesBastard 16y ago
Github has a bunch of security holes.....you'd be surprised what's out there right now.... here's a screenshot from some of my github expliots... http://i.imgur.com/irL01.png http://i.imgur.com/irL01.png
- kneath 16y ago
  As I recall, your account got suspended because of this and suddenly became extremely apologetic when you realized you needed your account for work the next day. There's a big difference between a security hole and acting like a jackass.
  - JamesBastard 16y ago
    if you look at the IRC logs for the day you'll see i specifically warned some employees what i was doing hours before i did it. you'll also see i was instantly unbanned and was making jokes about how my boss would be mad at me if i got banned from github. i could have easily not been detected doing this. i chose to to spam the site to see how fast it could respond. i got those 2k users in about 3 minutes or so....
- colonelxc 16y ago
  I don't get it? It looks just like the "explore" page on github... am I missing something?
  - there 16y ago
    the top trending project is a project he created to get to the top of the trending projects list.
  - savant 16y ago
    The number of watchers on the first repository.
tav 16y ago
I'm not really sure why this is an issue at all. Yes, "rogue" repositories could claim that you'd authored various commits. But, why would people be looking at these repos in the first place? There's a very strong builtin trust mechanism on GitHub — mainly due to the fact that repositories hang off of "users" instead of them hanging off of "projects". And, myself, when browsing around aimlessly on GitHub, tend to check out either reputable projects (where such behaviour is not likely to go unnoticed) or the repos of a hacker i'm interested in — who surely doesn't have much reason to fake their own commits? ;p Heh, maybe this could be the basis for a GitHub Reality TV show. "Tonight: DHH fakes his own death!" ;p
oomkiller 16y ago
Git makes PGP so ridiculously easy to do (as far as unix goes) that it shouldn't be that big of a deal to add the option.
jrockway 16y ago
Just like regular mail, e-mail, the bylines on articles, people on the phone, ... If you don't want people to worry about the integrity of your code, then "git tag -s" to sign a tag. Signing a tag makes it possible to verify the authenticity of the entire branch to that point.

43 points by timf 16y ago

timf 16y ago

This was just me verifying what I saw, that if you push commits to GitHub, it correlates the email address of authors introducing commits elsewhere. You can make it look like anyone you want is contributing patches, the avatar shows up, etc. This example commit does NOT show up in dhh's timeline, though. I am not going to start requiring PGP signing for my projects, they are not big enough to miss something fishy. This was just something I hadn't considered, it is probably an obvious issue to many already.

wwortiz 16y ago
I would hope people didn't blindly accept patches off of merit anyways, or is there another problem I am missing? Edit: not to say this shouldn't be fixed I am curious if this implies anything else that I may be missing.
- clemesha 16y ago
  No patch has been accepted (unless I mis-understood what you are saying). In fact, if it's not totally obvious to everyone that timf is the one that committed the latest commit, then this demonstration is noteworthy.
  - wwortiz 16y ago
    I was simply stating that patches shouldn't be accepted just because a high profile person submitted it (which this could possible be used to spoof for malicious intent). As for the second part I was wondering if this had any other implications such as committing to someone else repo or if it is just masking identities with another users.
lenni 16y ago
Would you care to elaborate a little? I only understand it partially. So, you aren't 'dhh' but you commited using his email address and it showed up as him?
- clemesha 16y ago
  You have it correct. What you say in your second sentence is exactly the issue. If this is "actually" a big issue or not is another question.
  - technoweenie 16y ago
    Sure, all it does is links the commit to a github login. It doesn't somehow give you access to any data that's not yours. You've just discovered another way to post spam.
- petercooper 16y ago
  It's on a par with using a forged From header over SMTP. You can send e-mail as pretty much anyone. (Though technologies like SPF are helping clamp down on this.) "Joe jobbing" is when spammers use real e-mail addresses in their From headers so that that person gets the flak. In a round about way, this is the same for patches/commits :-)
- jackowayed 16y ago
  He changed his git config so that user.email was david@loudthinking.com (The email DHH lists on GitHub). GitHub then automatically says "oh, this is by david@loudthinking.com, so let's put his avatar there and link to his profile as the author." Changing the config is as simple as git config user.email "david@loudthinking.com" And you can add a --global flag if you want that to be the default for all repos instead of just the one you're on. Edit: There's also some way to do it with a --author= flag when you commit.
rtomayko 16y ago
That's mostly correct. We use the email addresses provided in the commit Author and Committer fields and correlate them with the email addresses associated with GitHub user accounts. The commit Author/Committer email addresses are also used to fetch gravatar images even when no GitHub user account exists for the email. It's trivial to spoof these fields using the --author argument to git-commit(1), by setting the GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL environment variables, or by setting a different name/email using git-config(1).
- timf 16y ago
  Thanks. So it didn't cross my mind that this was some huge security flaw, I would have reported something like that privately. I hope starting this discussion does not cause any unecessary confusion. GitHub rocks, it has really changed our contributor attitudes. I am a happy, paying customer (another account) and just really hope you guys are around a long time!
  - rtomayko 16y ago
    > GitHub rocks, it has really changed the contributor attitudes for my main project, I am a paying customer (another account) Thanks! > and just really hope you guys are around a long time! We'll be here. It's a profitable business with a straightforward model and we intend to keep it that way.

adbge 16y ago

Might be an issue in that it could be used to damage someone's reputation by spoofing their avatar/etc and then trying to push malicious commits. That's what occurs to me at first glance, anyways.

petercooper 16y ago

We could call this "joe patching," named after the similar issue of "joe jobbing." :-)

JimBastard 16y ago

github has several security holes....this is nothing compared to what is live right now... here's a screenshot from some of my previous github exploits... http://i.imgur.com/irL01.png http://i.imgur.com/irL01.png

JamesBastard 16y ago

Github has a bunch of security holes.....you'd be surprised what's out there right now.... here's a screenshot from some of my github expliots... http://i.imgur.com/irL01.png http://i.imgur.com/irL01.png

kneath 16y ago
As I recall, your account got suspended because of this and suddenly became extremely apologetic when you realized you needed your account for work the next day. There's a big difference between a security hole and acting like a jackass.
- JamesBastard 16y ago
  if you look at the IRC logs for the day you'll see i specifically warned some employees what i was doing hours before i did it. you'll also see i was instantly unbanned and was making jokes about how my boss would be mad at me if i got banned from github. i could have easily not been detected doing this. i chose to to spam the site to see how fast it could respond. i got those 2k users in about 3 minutes or so....
colonelxc 16y ago
I don't get it? It looks just like the "explore" page on github... am I missing something?
- there 16y ago
  the top trending project is a project he created to get to the top of the trending projects list.
- savant 16y ago
  The number of watchers on the first repository.

tav 16y ago

I'm not really sure why this is an issue at all. Yes, "rogue" repositories could claim that you'd authored various commits. But, why would people be looking at these repos in the first place? There's a very strong builtin trust mechanism on GitHub — mainly due to the fact that repositories hang off of "users" instead of them hanging off of "projects". And, myself, when browsing around aimlessly on GitHub, tend to check out either reputable projects (where such behaviour is not likely to go unnoticed) or the repos of a hacker i'm interested in — who surely doesn't have much reason to fake their own commits? ;p Heh, maybe this could be the basis for a GitHub Reality TV show. "Tonight: DHH fakes his own death!" ;p

oomkiller 16y ago

Git makes PGP so ridiculously easy to do (as far as unix goes) that it shouldn't be that big of a deal to add the option.

jrockway 16y ago

Just like regular mail, e-mail, the bylines on articles, people on the phone, ... If you don't want people to worry about the integrity of your code, then "git tag -s" to sign a tag. Signing a tag makes it possible to verify the authenticity of the entire branch to that point.