4 ms·
> GitHub identifies people via their SSH key, not via a "name" or email address. Contrary to this, GitHub leans heavily on email addresses to identify contribu
by carussell 10y ago
> GitHub identifies people via their SSH key, not via a "name" or email address.
Contrary to this, GitHub leans heavily on email addresses to identify contributors—in fact it may be correct to say it relies entirely on email addresses. This comes from both the documentation[1] and is borne out by experiments I've done to verify this[2].
The only thing I'm aware of that's of note is if you superficially try to change the author of the patch to give a different attribution before pushing to GitHub, then GitHub will say something like "Other-Name committed with Real-You". In this case, it all comes from Git—Git has a notion of "committer" as distinct from "author". So what's happening in the case of e.g. `--author=Other-Name <fake@example>`, Git reads your config, which specifies e.g. Real-You, and so based on that and the `author` flag, will mark the commit with author Other-Name and committer Real-You. From this, GitHub displays the UI string of the form mentioned earlier.
For example, from a recent commit[3] to the vscode-docs repo, if you do:
$ git cat-file -p caa4bc3e50a96a93a1d4f5e39597cc3fc1cb9a4f
... then you get:
tree 86c221e0f9e7e986068c50971ac322c738f5812f
parent ccb9478342bba878111baedb412fb7f6911b40ad
author João Moreno <mail@joaomoreno.com> 1486451758 +0100
committer Greg Van Liew <gregvanl@microsoft.com> 1486481582 -0800
Improve `code` docs for macOS
Once again, this is all Git, and nothing specific to GitHub or any special inference that it derives from SSH keys (to my knowledge). If you have some other information, can you share it? Realistically, it's not feasible for GitHub to rely on SSH because it's not even necessary to set up SSH for your account. (Pushes from the command line can be done with a username/password pair—if you're hitting the https endpoint—and GitHub really likes people who do everything through their web UI. Forcing the latter group to mess with SSH is basically a non-starter, given GitHub's goals—which I'll clarify at every opportunity, is to be a social network first, and a software development platform second.)
1. https://help.github.com/articles/why-are-my-commits-linked-to-the-wrong-user/ https://help.github.com/articles/why-are-my-commits-linked-t...
2. http://www.colbyrussell.com/2016/02/13/keeping-a-low-profile-on-github.html http://www.colbyrussell.com/2016/02/13/keeping-a-low-profile...
3. https://github.com/Microsoft/vscode-docs/commit/caa4bc3e50a96a93a1d4f5e39597cc3fc1cb9a4f https://github.com/Microsoft/vscode-docs/commit/caa4bc3e50a9...
- chriswarbo 10y agoYes, I didn't mean to imply they're scraping information from keys or anything (e.g. looking them up in a web of trust, etc.); only that SSH keys are an "external" form of identifier. The git cli uses 'email-like identifiers', but they don't have to be working email addresses unless you're using git's email integration (and even then, you could use sendmail et al to redirect these fake emails through a real one). Of course, it's trivial to use multiple git configs (such that "Real-You" isn't really you), although it requires some vigilance. I worked with someone who maintained two separate GitHub accounts: one for "public" stuff, one for security/hacking related stuff (nothing nefarious; they went after bug bounties). They got really annoyed one day when they spotted that the drunk coding they'd done the night before had been committed using their public git config, so anyone who'd crawled/mirrored those repos (and of course GitHub themselves) would be able to tie the identities together!