18 ms·
Git-blame-someone-else
- rwmj 5y agoThe commit hash of the blamed commit and all ones after that change, so the system works. One day we may be able to reliably/easily generate SHA-1 collisions to really get someone else to take the blame :-)
- lifthrasiir 5y agoMissed opportunity: append random whitespace characters to all subsequent commits so that the first N characters of commit id are retained.
- cantsingh 5y agocombine this with Lucky Commit
- glxxyz 5y agogit commit --amend --author=[...]
- rwmj 5y agoWhich is almost exactly how this works: https://github.com/jayphelps/git-blame-someone-else/blob/8d854c2d78cb98afdb9f5a73240e06393260b327/git-blame-someone-else#L15 https://github.com/jayphelps/git-blame-someone-else/blob/8d8...
- rossmohax 5y ago`git replace` does it without rebasing, which is cleaner and likely to be left unnoticed by peers.
- er4hn 5y agoI'm going to use this as an example of why commit signing is really awesome for git repos.
- DougBTX 5y agoI was expecting this to be like `git blame`, but to automatically check previous revisions for any lines touched by the current user. That would be a fun toy :-)
- Hokusai 5y agoI runned a code formatter in our code base. Years later I was still 'blamed' for many things in our code as few files were untouched.
- jarofgreen 5y agoAt one company I did a project that among other things involved bringing in a code formatter. I deliberately tagged that commit with a generic author :-)
- ornornor 5y agoHaha, I did that too because most of our code is just so shitty I didn’t want the shame of it looking like I was the author.
- Ashanmaril 5y agoWe recently converted our monolith codebase at work from windows-1252 encoding to UTF-8 and now the entire project looks like it was written by 1 guy
- david_allison 5y agoYou can fix this! Look into the "ignore revs" file option on git blame or the option: blame.ignoreRevsFile https://git-scm.com/docs/git-blame#Documentation/git-blame.txt---ignore-revs-fileltfilegt https://git-scm.com/docs/git-blame#Documentation/git-blame.t...
- 5y ago
- rzzzt 5y agoRe: the introductory animation, NASA has .gov adresses, it is not a commercial entity. With that said, sign your commits!
- consp 5y agoThis somehow reminds me of how svn blame/praise was the same command.
- mcobzarenco 5y agoif you're not already enforcing signed commits, you deserve it
- Lapsa 5y agouseful tool. I like it
- easton 5y agoAnd if you want to do this for something before the code is written: https://github.com/jmathai/all-hands-on-deck https://github.com/jmathai/all-hands-on-deck
- stevebmark 5y agoStop using git blame to look up who authored code, it's not a useful tool. Use git log -S <string> to search for changes to that line (then repeat with the previous version of that line, until you find the original author), and/or git log -L to track changes to a code block. Don't waste your time with git blame.
- nicoburns 5y agoMy editor (sublime text) has built in git blame support. It's literally right-click -> blame file, and it will put the author of every line in the margin.
- Icathian 5y agoGitlens extension in vscode is quite good for this as well
- stevebmark 5y agoand?
- ffjffsfr 5y agohow is git log -S more efficient? You have to write whole line, what if line is long? What if you need to look at several lines within some range. git blame is much better than your git log -S
- DannyBee 5y agogit blame can't possibly work well in all cases, which is why the author is saying that. Git doesn't store what actually was changed. Git stores how to reconstruct the new file from the old file in a space efficient way. This is unrelated to storage of who changed what, only "what is the minimal way to reproduce the end state from the beginning state". As a result, tools like blame take the two versions and try to figure out what someone actually changed, trying to turn applesauce back into apples. Whether it gets it right or not has an element of luck to it (the diff algorithms are also often based on finding the minimal sequence of edits.). Whether it happens depends on the algorithm and it's heuristics, and often whether there is a single unique minimal sequences that could produce your end state from your beginning state (if not, it's not actually possible to say what you changed with 100% accuracy) git log -S instead is saying "give me all the times this line seems to have changed", and then you do the work of figuring out which were real and which are artifacts of the diff algorithm.
- bostonsre 5y agoCould be good for resume padding. O yea, I wrote 75% of linux...
- cratermoon 5y agoThis thought occurred to me, too. The example given is about pinning bad code on someone else, but the inverse is also possible: changing the author of good code to yourself. I'm kind of wondering, now, if there are some unscrupulous coders out there messing with their employer's internal git repos to give themselves credit for work other people did. I knew one guy who would create tickets, assign them to himself, and then abuse the tickets closed metric to inflate his productivity claims. He wasn't very subtle about it, either. Of course management ought to have been more skeptical of that, but .. stuff happens. Yeah, I work in information security for a living, how did you guess?
- mb7733 5y agoWell for one thing, the unscrupulous employee would need to have force push permissions to the origin repo. Even if they they did, once they change the history change, other developers working with the repo would be alerted of the remote branch changing out from under them next time they try to pull. And even if the change doesn't result in a conflict, and each of those other devs blindly accept the resulting merge, the original authors' commits will still be in the history resulting from the merge. So if those developers ever pushed anything, the original commits would be re-introduced. Now, it could be abused if a single developer inherits a project that nobody else has checked out. But it's still a high risk strategy for the unscrupulous dev.
- cratermoon 5y ago> Well for one thing, the unscrupulous employee would need to have force push permissions to the origin repo. Have you ever seen that old video "The website is down"? [1]. In it, the guy covers his own tracks with admin privileges. I'm not saying it's easy, just that it's possible.
- 5y ago
- cantsingh 5y agoaka 'git gaslight'
- brianpursley 5y agoIt’s not just blame. GitHub uses commits to build the contributor list on your repo home page, so you can make it look like it has some famous contributors: https://github.com/jayphelps/git-blame-someone-else/graphs/contributors https://github.com/jayphelps/git-blame-someone-else/graphs/c...
- nkozyra 5y agoOh man. I was thinking they'd probably patch that but ... how could they?
- albertgoeswoof 5y agoOnly show contributions with GPG signed commits
- hda111 5y agoGPG is the solution. It’s so easy to use.
- albertgoeswoof 5y agoYou are both right and wrong at the same time
- gpm 5y agoI'm actually shocked that's an issue. I assumed they were recording actions taken via the github UI and APIs, not the git commit log. If someone merges a pull request you opened, poof, you contributed the lines merged from that pull request regardless of the git author line. Same if you run `git push` with your github login credentials. Apart from attributing things to the wrong person, git author line seems like it must also have the issue of not attributing things at all. What if I signed up with a different email address than I use for git?
- DoctorOW 5y ago
- ffjffsfr 5y agoit runs git rebase under the hood, in production environment with multiple people pushing to repo it will break things and it'll be spotted immediately. So this actually shows how hard it is to spoof commit author, you can't do it without leaving a trace, git is a solid system.
- Regic 5y agoWell, if you collect commits on a feature branch you can just create a new one with a slightly different name - all the commits on your branch are rewritable before you push it in and create a pull request (deleting and pushing it again with different history does not work for me). I often do this for rebasing, I doubt anyone would have ever noticed if I changed the authors.
- jb1991 5y agoThis has saved me so many times. I’m sure I would have lost my job a while ago had I not been able to use this, it’s one of my most actively use tools. I’m sure eventually I’ll be losing my job, but at least this repo has enabled me to keep it a little bit longer.
- pixl97 5y agoI'll be keeping an eye on this account. I feel in a few months JB will be promoted to manager.
- birdyrooster 5y agoNow that’s a straight shooter with upper management written all over him.
- ornornor 5y agoCurious how do you get away with it without anyone noticing. Doesn’t this imply rewriting the master branch? Wouldn’t that cause noticeable issues for everyone else? Or maybe you’re the only active contributor on that codebase (but then who else can you blame?)
- MeinBlutIstBlau 5y agoAs someone else is saying, its obviously a joke. Even a halfway intelligent person would be able to create an alibi that they didnt do it.
- labster 5y agoOf course they didn’t do it. It was somebody else.
- craftinator 5y agoYou must be halfway intelligent!
- ggregoire 5y agoStill need to be able to "push --force" on the remote repo for this to be useful, right?
- saagarjha 5y agoYou can run it locally.
- shhsshs 5y agoThis is a great example of why you should enable vigilant mode [1] on your GitHub account and set your machine up to GPG sign your commits. [1] https://docs.github.com/en/github/authenticating-to-github/managing-commit-signature-verification/displaying-verification-statuses-for-all-of-your-commits https://docs.github.com/en/github/authenticating-to-github/m...
- teitoklien 5y agoBut if you gpg sign your commit Now all your contributors will have to sign their next commits too. My workmates would hate me if i introduced this to production.
- rsstack 5y agoI am the only person on my team who signs their commits. No one complained or noticed.
- jeroenhd 5y agoWhy do they have to sign their commits? Their contributions are unverified, as are any commits made in your name without your signature, but they don't have to do anything. You gain the ability to prove that a certain commit came from your machine or someone with full access to it, they don't. To be honest, everyone should be signing their commits in a professional environment. It takes minutes of work to set up and greatly increases the trust you can have in the code base. If you're scared of affecting your workflow, just don't protect the GPG keys with a password (dangerous) or use your operating system's trust store to unlock them at login (less dangerous, but still suboptimal). I sign my work commits without ever entering a password in a prompt. Some of my coworkers also sign their commits, most of them don't.
- bentcorner 5y agoIf you don't sign your commits you leave yourself an escape hatch just in case you need to wash your hands of a PR. /s
- 5y ago
- dang 5y agoOthers were to blame for past threads: Git Blame-Someone-Else - https://news.ycombinator.com/item?id=21004193 https://news.ycombinator.com/item?id=21004193 - Sept 2019 (66 comments) Git-blame-someone-else – Blame someone else for your bad code - https://news.ycombinator.com/item?id=11049993 https://news.ycombinator.com/item?id=11049993 - Feb 2016 (65 comments)
- infogulch 5y agoDoes it feel like gardening? Moderating HN that is. It'd have to be one of those "wild gardens" that's mostly the plants doing what they want with a bit of nudging. Pull out a weed here, tie up some branches there, clear the path, give a little extra water to something that didn't get a good chance yet, etc. Sorry for the OT, I was just curious if that analogy resonated.
- throwaway984393 5y agoProbably more like a farm, full of pests and dog poop
- Clewza313 5y agoI think you mean bullshit and pig swill.
- dang 5y agoIt's a nice analogy! Or at least a flattering one. Thanks either way :)
- deleted 5y ago[deleted]
- 40four 5y agoThis is hilarious! Got a good laugh from this. It also illustrates how easy it is to impersonate other people in Git. I’m surprised this isn’t discussed more. To be honest, when you really think about it, any commit that is not GPG signed is unverifiable. It could be anybody. I wish signing commits was more widespread.
- baud147258 5y agoyeah, we recently started switching from mercurial to bitbucket (not our choice) and we took the time to make commit signing mandatory, piggybacking on the infrastructure that was already in place to sign the mercurial commit, but with new gpg keys as the mercurial commits were signed with p12 keys, which are not supported by git/bitbucket (can't remember which).
- throwaway984393 5y agoIf you sign your commits, you can't claim that somebody else rewrote the Git history with you as the author. Plausible deniability...
- DaiPlusPlus 5y agoConversely, if you do sign your commits but are careless if your keys (e.g. storing your private-key directly in your repo...) then you've got even more work for yourself.
- KingCobra 5y agoIt's good but on production branch rebasing will change the commit history with it.
- phamilton 5y agoAnyone else pick up on the Fred Randall reference?
- jacobevelyn 5y agoIn a similar vein, I’m the author of git-self-blame: https://github.com/JacobEvelyn/git-self-blame https://github.com/JacobEvelyn/git-self-blame (Still among the best-commented code I’ve ever written.)
- saagarjha 5y agoThis tool is actually genuinely useful when you’re working with your local tree and did an operation that messes with authorship that you would like to fix. (For example, if you squashed two things together and then extricated the old commit out by hand: you’d like to give ownership of that to the original author). These days I just amend manually, but this is a nice way to wrap that functionality up into something that is easy to use.
- mad_vill 5y agoWho needs this when you have the broken "blame" in azure devops/repos?
- khendron 5y agoI've always thought 'git blame' was a badly named command. The word 'blame' has such negativity attached to it. The command should have been called 'git who'.
- antris 5y ago'git blame' is an excellent name, because who write a piece of code shouldn't matter. For a coder that's ready to take responsibility, figuring out who did what doesn't matter. All that matters what the code is now, whether it serves the purpose of the software and whether/how it should be changed. I've never needed to use 'git blame' and I see no reason to, unless you really are just trying to look for a person to blame.
- kadoban 5y agoIt's very useful to figure out who to ask about a particular piece of code. It's also occasionally useful to track down when it was changed (what commit) to give context for why things are the way they are.
- hinkley 5y agoIf the person who always has trouble with boundary conditions wrote the code, then I can assume the missing boundary condition was accidental, not some subtle “feature” that I need to out-clever. Also if the code is from a time frame before we agreed to stop writing code a certain way, that’s one thing. If it’s new, the person needs some feedback.
- maemre 5y agoSeconded! I am the sole contributor (or the main one) on most of the git repos I am working on--they are research prototypes and I'm a PhD student so it's mostly solo work. So, I'm the only person to "blame" when looking at a piece of code, but it is a useful command that lets me find the commit and the context for why I implemented an algorithm in a certain way after a few months. Another example: I use the nightly Rust compiler as a library, which have unstable API. git-blame helped track down which commits change the APIs I use when I'm updating the compiler version my project depends on. git-bisect is the other useful part of git for this purpose.
- SURA 5y agoThis is a joke, it modified the commit id
- beardyw 5y agoI think the problem is "commit". I would like to propose "lets-see-how-things-go-for-a-while" as an alternative.