5 ms·

GitHub’s response is pretty surprising. How can anyone think this is expected? Having to follow Git’s commit message emails makes sense and indeed anybody can u

GitHub’s response is pretty surprising. How can anyone think this is expected? Having to follow Git’s commit message emails makes sense and indeed anybody can use any email they want to make a commit. But then for GitHub to make the connection between (unverified) commit emails and (unverified) GitHub.com accounts is the issue for me. Since they can’t verify the commit email belongs to a GitHub account, why show that as though it were true?

berkes 5y ago
And if "the proper way to verify committer identity is, as per GitHub's response, a cryptographic signature", Github is certainly not pushing this. If the only real security around attribution is "a cryptographic signature", GitHub could do a lot better in pushing this, making it essential part of the signup or "getting started" and such.
fragmede 5y ago
Because that's git's underlying mechanisms in action. In a distributed system, there's no centralized database to check things against, so there's no (distributed) way to do verification, leading to the issue described here. With the use of public key cryptography, there's a disconnected way to authenticate commit, and it works as well as public key cryptography does, but GitHub has all the levers needed to moved the needle, with `hub` and them holding public keys for registered users.
- INTPenis 5y ago
  Really? In this case isn't it just the Github web service that makes a decision on what to display? Sure if you clone the git repo you get the e-mail address, but then you also won't get any information about who the email belongs to on Github. I don't see how the design of Git affects this issue. This is simply one if clause away from being solved in Githubs frontend source code. Just check if email.verified: display the user, else, don't do that. In the else-case all you'd get is a situation where one unknown user has Linus e-mail in their list of e-mail addresses, in Githubs DB, and a bunch of git commit logs with the same e-mail. No one would ever make the connection from the commit log to the list of Emails in the DB. Because the e-mail hasn't been verified. It's as simple as that to me but I could be wrong.
  - not2b 5y ago
    Github could easily add its own handling for historical addresses of well-known developers, and block others from masquerading as them, once abuses like this are reported.
    - jodrellblank 5y ago
      One rule for famous developers, another for all the rest of us. Completely backwards because everyone knows Linus made Git so that's no threat to him, but someone retro-claiming authorship of normal person's work is much worse because nobody knows differently. Also expecting Github support people to mediate "he said/she said" arguments about who made what commits, or owned what email address that many years ago.
      - not2b 5y ago
        There are some kinds of attacks that are more likely to be launched against well known people. But even for lesser-known developers their names with corresponding addresses will appear in the archives of mailing lists, and this could be used to correct the record. But if there's no record of someone at all then there isn't an easy way to detect this kind of abuse.
- nebulous1 5y ago
  > Because that's git's underlying mechanisms in action. no? git just has an email field on the commit. it's github that has decided to allow people to associate unverified emails with their accounts, and also display this association whereever the email is listed in a commit.
  - itake 5y ago
    I don't see how verifying the email fixes the problem. Emails (like domains) expire and the original user of the address may lose control of them.
jodrellblank 5y ago
What happens if Linus Torvalds has a verified Github account, and I commit to my rudely named project on my local computer with his email address and then push to Github; do they then show the commit with his Github account because his Github email is verified?
- leeoniya 5y ago
  > and I commit to my rudely named project on my local computer with his email address and how exactly would this be out of character for the real Linus Torvalds?
- jreese 5y ago
  Yes, and there are a number of past stunts that include forking the Linux repo, pushing fake/misleading commits, and then showing how Github lets you see those commits in a context that implies they are part of the upstream Linux repo.
  - charcircuit 5y ago
    Github now shows a warning when people visit links like that
    - seba_dos1 5y ago
      Not on every relevant view though, so there are still new waves of pranks and surprised people.
inopinatus 5y ago
The response seems a lazy, thoughtless, self-serving cop-out, one that permits a false identity claim and then pushes the entire burden of challenging it back to the primary victim, who may well be unwitting, and where secondary victims (anyone defrauded by believing a false attribution) have no standing at all. You can file the whole line of thinking - from design to support - under "worst practices" and "things not to emulate in your own product". When it comes to handling how unverified author identity is presented and cross-reference, Github could stand to do a lot better. Fortunately, the problem appears confined to Github's web interface; a git show --quiet e83c516 still produces Author: Linus Torvalds <torvalds@linux-foundation.org> Date: Thu Apr 7 15:13:13 2005 -0700 Initial revision of "git", the information manager from hell

berkes 5y ago

And if "the proper way to verify committer identity is, as per GitHub's response, a cryptographic signature", Github is certainly not pushing this. If the only real security around attribution is "a cryptographic signature", GitHub could do a lot better in pushing this, making it essential part of the signup or "getting started" and such.

fragmede 5y ago

Because that's git's underlying mechanisms in action. In a distributed system, there's no centralized database to check things against, so there's no (distributed) way to do verification, leading to the issue described here. With the use of public key cryptography, there's a disconnected way to authenticate commit, and it works as well as public key cryptography does, but GitHub has all the levers needed to moved the needle, with `hub` and them holding public keys for registered users.

INTPenis 5y ago
Really? In this case isn't it just the Github web service that makes a decision on what to display? Sure if you clone the git repo you get the e-mail address, but then you also won't get any information about who the email belongs to on Github. I don't see how the design of Git affects this issue. This is simply one if clause away from being solved in Githubs frontend source code. Just check if email.verified: display the user, else, don't do that. In the else-case all you'd get is a situation where one unknown user has Linus e-mail in their list of e-mail addresses, in Githubs DB, and a bunch of git commit logs with the same e-mail. No one would ever make the connection from the commit log to the list of Emails in the DB. Because the e-mail hasn't been verified. It's as simple as that to me but I could be wrong.
- not2b 5y ago
  Github could easily add its own handling for historical addresses of well-known developers, and block others from masquerading as them, once abuses like this are reported.
  - jodrellblank 5y ago
    One rule for famous developers, another for all the rest of us. Completely backwards because everyone knows Linus made Git so that's no threat to him, but someone retro-claiming authorship of normal person's work is much worse because nobody knows differently. Also expecting Github support people to mediate "he said/she said" arguments about who made what commits, or owned what email address that many years ago.
    - not2b 5y ago
      There are some kinds of attacks that are more likely to be launched against well known people. But even for lesser-known developers their names with corresponding addresses will appear in the archives of mailing lists, and this could be used to correct the record. But if there's no record of someone at all then there isn't an easy way to detect this kind of abuse.
nebulous1 5y ago
> Because that's git's underlying mechanisms in action. no? git just has an email field on the commit. it's github that has decided to allow people to associate unverified emails with their accounts, and also display this association whereever the email is listed in a commit.
- itake 5y ago
  I don't see how verifying the email fixes the problem. Emails (like domains) expire and the original user of the address may lose control of them.

jodrellblank 5y ago

What happens if Linus Torvalds has a verified Github account, and I commit to my rudely named project on my local computer with his email address and then push to Github; do they then show the commit with his Github account because his Github email is verified?

leeoniya 5y ago
> and I commit to my rudely named project on my local computer with his email address and how exactly would this be out of character for the real Linus Torvalds?
jreese 5y ago
Yes, and there are a number of past stunts that include forking the Linux repo, pushing fake/misleading commits, and then showing how Github lets you see those commits in a context that implies they are part of the upstream Linux repo.
- charcircuit 5y ago
  Github now shows a warning when people visit links like that
  - seba_dos1 5y ago
    Not on every relevant view though, so there are still new waves of pranks and surprised people.

inopinatus 5y ago

The response seems a lazy, thoughtless, self-serving cop-out, one that permits a false identity claim and then pushes the entire burden of challenging it back to the primary victim, who may well be unwitting, and where secondary victims (anyone defrauded by believing a false attribution) have no standing at all. You can file the whole line of thinking - from design to support - under "worst practices" and "things not to emulate in your own product". When it comes to handling how unverified author identity is presented and cross-reference, Github could stand to do a lot better. Fortunately, the problem appears confined to Github's web interface; a git show --quiet e83c516 still produces Author: Linus Torvalds <torvalds@linux-foundation.org> Date: Thu Apr 7 15:13:13 2005 -0700 Initial revision of "git", the information manager from hell