3 ms·

Of course now every pull is authenticated and they can track exactly what users are pulling from what public repositories. Before it used to be that I only real

Of course now every pull is authenticated and they can track exactly what users are pulling from what public repositories. Before it used to be that I only really authenticated when I did a git push. So now when using plain git the choices are to have every action tracked, or to go through a very annoying process involving randomly generated keys. Not that they couldn't guess that information based on IP address (presuming you're not behind a university NAT or something), but removing password auth does seem like a pretty clear attempt at gathering more user data.

lewiscollard 5y ago
> So now when using plain git the choices are to have every action tracked, or to go through a very annoying process involving randomly generated keys. EDIT: this alias has a bug that means it doesn't work as intended, see below, don't use it If you're that worried, I threw this shitty Bash function together in five minutes just now; stick this in your bashrc and then `anongit ...` instead of `git`: anongit () { mkdir -p ~/.random-ssh-keys KEYNAME=$(openssl rand -hex 12) KEYFILE=~/.random-ssh-keys/$KEYNAME ssh-keygen -q -C $KEYNAME -N "" -f $KEYFILE GIT_SSH_COMMAND="ssh -i $KEYFILE" git "$@" } Problem solved! ...or you could clone over HTTPS instead :)
- judge2020 5y ago
  GitHub doesn't just need any SSH key, it needs an SSH key attached to an account, probably for abuse/DoS prevention purposes.
  - lewiscollard 5y ago
    Shit, you're probably right. It only worked because I didn't tell SSH to only use the specified identity files (I threw it together in five minutes without really testing it, you can forgive me). Changing one of the lines to this (which it should have been all along): GIT_SSH_COMMAND="ssh -i $KEYFILE -o IdentitiesOnly=yes" git "$@" ...comes up with "Permission denied (publickey)". So, yep, you're 100% right. Oh well. There's still HTTPS!
deleted 5y ago
[deleted]
alophawen 5y ago
Nonsense. You have been able to clone over https since day 1 of Github and still can: git clone https://github.com/user/repository

lewiscollard 5y ago

> So now when using plain git the choices are to have every action tracked, or to go through a very annoying process involving randomly generated keys. EDIT: this alias has a bug that means it doesn't work as intended, see below, don't use it If you're that worried, I threw this shitty Bash function together in five minutes just now; stick this in your bashrc and then `anongit ...` instead of `git`: anongit () { mkdir -p ~/.random-ssh-keys KEYNAME=$(openssl rand -hex 12) KEYFILE=~/.random-ssh-keys/$KEYNAME ssh-keygen -q -C $KEYNAME -N "" -f $KEYFILE GIT_SSH_COMMAND="ssh -i $KEYFILE" git "$@" } Problem solved! ...or you could clone over HTTPS instead :)

judge2020 5y ago
GitHub doesn't just need any SSH key, it needs an SSH key attached to an account, probably for abuse/DoS prevention purposes.
- lewiscollard 5y ago
  Shit, you're probably right. It only worked because I didn't tell SSH to only use the specified identity files (I threw it together in five minutes without really testing it, you can forgive me). Changing one of the lines to this (which it should have been all along): GIT_SSH_COMMAND="ssh -i $KEYFILE -o IdentitiesOnly=yes" git "$@" ...comes up with "Permission denied (publickey)". So, yep, you're 100% right. Oh well. There's still HTTPS!

deleted 5y ago

[deleted]

alophawen 5y ago

Nonsense. You have been able to clone over https since day 1 of Github and still can: git clone https://github.com/user/repository