4 ms·
That's mostly correct. We use the email addresses provided in the commit Author and Committer fields and correlate them with the email addresses associated with
by rtomayko 16y ago
That's mostly correct. We use the email addresses provided in the commit Author and Committer fields and correlate them with the email addresses associated with GitHub user accounts. The commit Author/Committer email addresses are also used to fetch gravatar images even when no GitHub user account exists for the email.
It's trivial to spoof these fields using the --author argument to git-commit(1), by setting the GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL environment variables, or by setting a different name/email using git-config(1).
- timf 16y agoThanks. So it didn't cross my mind that this was some huge security flaw, I would have reported something like that privately. I hope starting this discussion does not cause any unecessary confusion. GitHub rocks, it has really changed our contributor attitudes. I am a happy, paying customer (another account) and just really hope you guys are around a long time!
- rtomayko 16y ago> GitHub rocks, it has really changed the contributor attitudes for my main project, I am a paying customer (another account) Thanks! > and just really hope you guys are around a long time! We'll be here. It's a profitable business with a straightforward model and we intend to keep it that way.