4 ms·

It bothers me a bit that the project has weak commit messages like this: https://github.com/sakurity/securelogin/commit/975332ae0b0e290d27fdefb66d66f5bc7c78471

It bothers me a bit that the project has weak commit messages like this: https://github.com/sakurity/securelogin/commit/975332ae0b0e290d27fdefb66d66f5bc7c784712 https://github.com/sakurity/securelogin/commit/975332ae0b0e2... Literally just "1". Tells me nothing about what's happening in this change, and from the diff, it looks like quite a lot ("118 changed files with 283 additions and 179 deletions").

amingilani 9y ago
From what I can tell, it fixed issue #1 Besides, everyone writes shitty messages every now and then. Don't judge their code by their use of a VCS. It's like judging a person's articles by their notes. I've got terrible handwriting.
- cyphar 9y ago
  Except that the commit history is actually important when auditing a security-sensitive project. After reading the guidelines for the Linux kernel I've always given full and proper commit descriptions for effectively all of my commits (with exceptions for projects which don't matter, and such messages aren't going to be read by anyone -- including me). I really wish more people did this, because it makes bisecting, backporting and otherwise spelunking projects much easier. To put it in your analogy, it wouldn't be fair to judge a programmer by their handwriting. But it might be fair to judge a secretary by their handwriting (you'd be annoyed if your secretary didn't write down important details, or wrote them in a way that nobody could read them).
  - sillysaurus3 9y ago
    It's not really true to say that the commit history of a project is an important aspect in regards to security. Whether it's security-sensitive or not, a project has either been audited or it hasn't. And an audit doesn't rely on commit messages.
    - cyphar 9y ago
      Yes, but usually audits are of a single snapshot in the repo's history. Understanding why a change was made is quite important, especially if someone touched security-sensitive code.
    - deleted 9y ago
      [deleted]
- nmjohn 9y ago
  > Don't judge their code by their use of a VCS. It's like judging a person's articles by their notes. I've got terrible handwriting. Except notes rarely are intended to be public and used for communication with other developers. While I agree that bad commit messages every now and then are not a big deal - that is not what the original commenter was referring to. Of the 23 commit messages, 8 of them are just "1". The only meaningful commit message was from a 3rd party PR that was merged. For security-related code, "hygienic" coding practices, including quality commit messages, are - at least in my eyes - important.
  - homakov 9y ago
    Nevermind initial technical sync commits, not my fault Git requires -m.
    - cyphar 9y ago
      It doesn't. `git commit` will open your $EDITOR to let you modify the full commit message. I would recommend looking at how Linux kernel commit messages are structured.
noobermin 9y ago
Talk about as substance-less criticism as any. A lot of the criticism of his/er project here seems to be on non-substantive things (commit messages, tone of the medium article) and not on the substance (the actual fucking protocol). Classic HN poo-poo'ing on anything that either competes with their service or they've missed the boat on.
- deavmi 9y ago
  Yeah that reply was stupid. I understand good commit.messages are needed but to fully understand the code - READ all of it. Sorry.

amingilani 9y ago

From what I can tell, it fixed issue #1 Besides, everyone writes shitty messages every now and then. Don't judge their code by their use of a VCS. It's like judging a person's articles by their notes. I've got terrible handwriting.

cyphar 9y ago
Except that the commit history is actually important when auditing a security-sensitive project. After reading the guidelines for the Linux kernel I've always given full and proper commit descriptions for effectively all of my commits (with exceptions for projects which don't matter, and such messages aren't going to be read by anyone -- including me). I really wish more people did this, because it makes bisecting, backporting and otherwise spelunking projects much easier. To put it in your analogy, it wouldn't be fair to judge a programmer by their handwriting. But it might be fair to judge a secretary by their handwriting (you'd be annoyed if your secretary didn't write down important details, or wrote them in a way that nobody could read them).
- sillysaurus3 9y ago
  It's not really true to say that the commit history of a project is an important aspect in regards to security. Whether it's security-sensitive or not, a project has either been audited or it hasn't. And an audit doesn't rely on commit messages.
  - cyphar 9y ago
    Yes, but usually audits are of a single snapshot in the repo's history. Understanding why a change was made is quite important, especially if someone touched security-sensitive code.
  - deleted 9y ago
    [deleted]
nmjohn 9y ago
> Don't judge their code by their use of a VCS. It's like judging a person's articles by their notes. I've got terrible handwriting. Except notes rarely are intended to be public and used for communication with other developers. While I agree that bad commit messages every now and then are not a big deal - that is not what the original commenter was referring to. Of the 23 commit messages, 8 of them are just "1". The only meaningful commit message was from a 3rd party PR that was merged. For security-related code, "hygienic" coding practices, including quality commit messages, are - at least in my eyes - important.
- homakov 9y ago
  Nevermind initial technical sync commits, not my fault Git requires -m.
  - cyphar 9y ago
    It doesn't. `git commit` will open your $EDITOR to let you modify the full commit message. I would recommend looking at how Linux kernel commit messages are structured.

noobermin 9y ago

Talk about as substance-less criticism as any. A lot of the criticism of his/er project here seems to be on non-substantive things (commit messages, tone of the medium article) and not on the substance (the actual fucking protocol). Classic HN poo-poo'ing on anything that either competes with their service or they've missed the boat on.

deavmi 9y ago
Yeah that reply was stupid. I understand good commit.messages are needed but to fully understand the code - READ all of it. Sorry.