4 ms·

From what I can tell, it fixed issue #1 Besides, everyone writes shitty messages every now and then. Don't judge their code by their use of a VCS. It's like ju

From what I can tell, it fixed issue #1 Besides, everyone writes shitty messages every now and then. Don't judge their code by their use of a VCS. It's like judging a person's articles by their notes. I've got terrible handwriting.

cyphar 9y ago
Except that the commit history is actually important when auditing a security-sensitive project. After reading the guidelines for the Linux kernel I've always given full and proper commit descriptions for effectively all of my commits (with exceptions for projects which don't matter, and such messages aren't going to be read by anyone -- including me). I really wish more people did this, because it makes bisecting, backporting and otherwise spelunking projects much easier. To put it in your analogy, it wouldn't be fair to judge a programmer by their handwriting. But it might be fair to judge a secretary by their handwriting (you'd be annoyed if your secretary didn't write down important details, or wrote them in a way that nobody could read them).
- sillysaurus3 9y ago
  It's not really true to say that the commit history of a project is an important aspect in regards to security. Whether it's security-sensitive or not, a project has either been audited or it hasn't. And an audit doesn't rely on commit messages.
  - cyphar 9y ago
    Yes, but usually audits are of a single snapshot in the repo's history. Understanding why a change was made is quite important, especially if someone touched security-sensitive code.
  - deleted 9y ago
    [deleted]
nmjohn 9y ago
> Don't judge their code by their use of a VCS. It's like judging a person's articles by their notes. I've got terrible handwriting. Except notes rarely are intended to be public and used for communication with other developers. While I agree that bad commit messages every now and then are not a big deal - that is not what the original commenter was referring to. Of the 23 commit messages, 8 of them are just "1". The only meaningful commit message was from a 3rd party PR that was merged. For security-related code, "hygienic" coding practices, including quality commit messages, are - at least in my eyes - important.
- homakov 9y ago
  Nevermind initial technical sync commits, not my fault Git requires -m.
  - cyphar 9y ago
    It doesn't. `git commit` will open your $EDITOR to let you modify the full commit message. I would recommend looking at how Linux kernel commit messages are structured.

cyphar 9y ago

Except that the commit history is actually important when auditing a security-sensitive project. After reading the guidelines for the Linux kernel I've always given full and proper commit descriptions for effectively all of my commits (with exceptions for projects which don't matter, and such messages aren't going to be read by anyone -- including me). I really wish more people did this, because it makes bisecting, backporting and otherwise spelunking projects much easier. To put it in your analogy, it wouldn't be fair to judge a programmer by their handwriting. But it might be fair to judge a secretary by their handwriting (you'd be annoyed if your secretary didn't write down important details, or wrote them in a way that nobody could read them).

sillysaurus3 9y ago
It's not really true to say that the commit history of a project is an important aspect in regards to security. Whether it's security-sensitive or not, a project has either been audited or it hasn't. And an audit doesn't rely on commit messages.
- cyphar 9y ago
  Yes, but usually audits are of a single snapshot in the repo's history. Understanding why a change was made is quite important, especially if someone touched security-sensitive code.
- deleted 9y ago
  [deleted]

nmjohn 9y ago

> Don't judge their code by their use of a VCS. It's like judging a person's articles by their notes. I've got terrible handwriting. Except notes rarely are intended to be public and used for communication with other developers. While I agree that bad commit messages every now and then are not a big deal - that is not what the original commenter was referring to. Of the 23 commit messages, 8 of them are just "1". The only meaningful commit message was from a 3rd party PR that was merged. For security-related code, "hygienic" coding practices, including quality commit messages, are - at least in my eyes - important.

homakov 9y ago
Nevermind initial technical sync commits, not my fault Git requires -m.
- cyphar 9y ago
  It doesn't. `git commit` will open your $EDITOR to let you modify the full commit message. I would recommend looking at how Linux kernel commit messages are structured.