5 ms·
"email addresses are part of the metadata for each individual commit. When those commits are pushed to remote hosting services like GitHub, those email addresse
by aadithpm 7y ago
"email addresses are part of the metadata for each individual commit. When those commits are pushed to remote hosting services like GitHub, those email addresses become visible not only to fellow developers, but also to malicious actors aiming to exploit them."
Isn't this overblown a little bit? If it's part of the metadata and it's pushed to a public space, how is it a 'large-scale-exploit'? I might be ignorant of a few things here so would love to be corrected on this.
- spunker540 7y agoI agree it's a little overblown. But Github should really figure out quickly how to not expose emails like that. I think many developers don't realize how accessible it is -- typically the email is set in some .git profile that you set up once, maybe not even in connection to github. It's not obvious that when you're using Github, your email from that file is being made public. Also this is somewhat worse than your typical email leak because the email address can be tied to all the github activity, which in many cases includes a lot of professional activity. Targeted phishing (aka spearfishing) has a lot more to go off of.
- Techbrunch 7y agoIf you haven't already I suggest you go to Your Github Settings > Emails and check "Keep my email addresses private" and "Block command line pushes that expose my email"
- human20190310 7y agoAre there any negative consequences to simply putting garbage in the email field rather than a dummy email address, whether on github or for git in general?