3 ms·

Supposedly, you can activate "Keep my email addresses private" in https://github.com/settings/emails https://github.com/settings/emails which should replace you

Supposedly, you can activate "Keep my email addresses private" in https://github.com/settings/emails https://github.com/settings/emails which should replace your actual email with a GitHub provided relay-address. You can also set that relay-address as your git commit email. It's unclear if the GitHub API will also show that email though, where I think they are getting the emails from in the first place. What we collectively can do is to send an email to support@github.com every time it happens, with the repositories/email addresses involved in this, and short-term GitHub will remove them from the platform (making it less profitable for them to do so as they'll get removed) and hopefully over time GitHub will improve protecting their users privacy.

sbarre 5y ago
I swear I set my email to private on Github years ago, and I just checked and it was not set to private, which definitely explains why I've been getting these emails too. Thanks for bringing this up, if only to prompt me to double-check my own settings. :-)
tiffanyh 5y ago
When has it ever been a practice to publicly display a users email address? Shouldn't this be off by default.
- blueflow 5y ago
  The /$user/$repo/commit/$commit.patch endpoint leaks the committers eMail like a git clone+git log would. Cross check with the github user of the same commits HTML view.
semiquaver 5y ago
There’s not much more github can do about this because of how git works: git commits form a merkle tree (aka blockchain): each commit is a hash of its contents (including the author’s email) as well as the entire history to that point. When you commit to a public repo, the email you commit with is publicly visible forever unless a repo owner rewrites history and force pushes. GitHub has an option to create web commits with private non-routable emails and to block pushes you inadvertently attempt which include commits made with your public email that you choose to keep private. Filtering existing emails from the API wouldn’t work since scrapers can just as easily clone the repo, which (by git’s design) cannot be altered without breaking everything. (Disclosure: I am a GitHub employee)

sbarre 5y ago

I swear I set my email to private on Github years ago, and I just checked and it was not set to private, which definitely explains why I've been getting these emails too. Thanks for bringing this up, if only to prompt me to double-check my own settings. :-)

tiffanyh 5y ago

When has it ever been a practice to publicly display a users email address? Shouldn't this be off by default.

blueflow 5y ago
The /$user/$repo/commit/$commit.patch endpoint leaks the committers eMail like a git clone+git log would. Cross check with the github user of the same commits HTML view.

semiquaver 5y ago

There’s not much more github can do about this because of how git works: git commits form a merkle tree (aka blockchain): each commit is a hash of its contents (including the author’s email) as well as the entire history to that point. When you commit to a public repo, the email you commit with is publicly visible forever unless a repo owner rewrites history and force pushes. GitHub has an option to create web commits with private non-routable emails and to block pushes you inadvertently attempt which include commits made with your public email that you choose to keep private. Filtering existing emails from the API wouldn’t work since scrapers can just as easily clone the repo, which (by git’s design) cannot be altered without breaking everything. (Disclosure: I am a GitHub employee)