7 ms·
GitHub Renamed Me (2014)
- pfarrell 3y agoWithout any context or followup, this seems like old news that doesn't need to be rehashed on the front page today. This event pre-dates the Microsoft purchase of Github.
- afterburner5 3y agoAlso considering that since the acquisition, they won't do anything to dissuade name-squatting anymore, despite their terms of service still suggesting otherwise
- ddalcino 3y agoThis is from 2014. Was there ever any resolution to this? I don’t see any previous discussions about this on HN.
- advisedwang 3y agohttps://github.com/rbishop-xx https://github.com/rbishop-xx still points to the author and https://github.com/rbishop https://github.com/rbishop still points to the Richard B mentioned in the post. So if there was a resolution it didn't reverse the rename.
- maronato 3y agoThe author created a new GH account https://github.com/russbishop https://github.com/russbishop
- jlnthws 3y agoI was early adopter and managed to get a 2-letter username but I’ve also been renamed to -xx without notice and any explanation :(
- heinekan 3y agoI’ve been on the other side of this. I asked GitHub if they could change my username to one that was already taken. As long as the account does not have repos of their own and was deemed sufficiently inactive they can take it. The support staff approved my request, but I have friends who’ve gotten declined.
- ddalcino 3y agoSounds like a believable explanation. > I created my account two years ago in anticipation of being able to open-source more code and I wanted to reserve my name; I had a couple of forked repos but that's it.
- cortesoft 3y agoYeah, sounds like GitHub doesn't let people squat usernames. The author says GitHub can 'modify his repos at will', but earlier he says he doesn't even have any repos besides a few forks (which were likely not modified)
- jperras 3y agoI've actually had a (great) username completely blackholed by github. I'm still a bit salty about it. I had received an email several years ago informing me that it was going to be removed. They gave me the equivalent to a coupon for a free year of the github personal plan as compensation. To this day it'll tell you that the username is "unavailable" if you try to sign up with it, and the page just 404s.
- asylteltine 3y agoAnd it’s called?
- charcircuit 3y agomalware is probably the best known case of this Today the profile just 404s https://github.com/malware https://github.com/malware edit: yep this is his account
- seszett 3y agoI can't find a followup, but it seems like "rbishop-xx" is still there, "rbishop" still owned by someone else, and Russ Bishop has moved on to the user "russbishop". It's still a bit curious and troublesome.
- dobladov 3y agoThis can cause problems in repositories with CODEOWNERS files, at the very minimum the change should be notified.
- OJFord 3y agoIf old guy has (or creates without noticing the name change) a (possibly private!) repo called 'test', and then new user creates one with the same name, when old guy pushes... I assume they think their checking for emptiness and inactivity covers these cases to some reasonable likelihood.
- bastawhiz 3y agoNothing will happen when the old guy pushes because the SSH key was changed.
- OJFord 3y agoWell, or was it? Unclear to me why they did that in TFA - if they just changed the name, keeping same SSH key on that one (now under a new name) would be fine, helpful even. We don't know if it was changed/removed on the old name (just assume/hope so).
- bastawhiz 3y agoThe post opens with the author describing how his key wouldn't work. But moreover, his account was renamed. Git has no knowledge of usernames. If the old key was kept on the account that was renamed, it wouldn't have given anyone access to anything new.
- OJFord 3y agoI didn't say git did anything with GitHub usernames. Yes it would, OP would hypothetically push to old user/org not realising their namespace had changed, but the key would check out, and potentially what was private would now be public. But anyway, it was a hypothetical, and relatively unlikely, since for real damage (what should be private being public) you'd need to know or be misfortunate/lucky in happening to use exactly the right (or wrong) repo name anyway. And as I said hopefully/I assume they do wipe remove the key anyway.
- iamthejuan 3y agoMy user ID in Github is username and they just suddenly name it also to usernamex.
- _jal 3y agoNot github, but I signed up for a service with the username 'duplicate_user_id'. It seems someone there didn't find that as amusing as I did, locked the account, and refused service. I can only guess they thought it was setup for some sort of scam, but I can't imagine what.
- duped 3y agoSeems like a reasonable approach to namesquatting, although an email notice would probably have been nice.
- ghusto 3y agoIs it though? For one thing it doesn't stop squatting, since all an actual squatter has to do is create a repo with some legit looking code. All this does is inconvenience people like the author who have legitimate reasons for not having uploaded anything yet.
- duped 3y agoIt seems like GH admins are capable of looking at a user and making a judgement call (no repos, no activity, no SSH keys, and a few forks) to determine that the username is being squatted. And based on the article, the author was just name squatting. I don't think there's a distinction between "legitimate" or not - use it or lose it.
- epcoa 3y agoUse it or lose it is a good base policy. Just because it isn’t perfect does not change that. Two years(!) is a long time to be sitting idly on a name and is squatting regardless of intent or circumstance.
- squeaky-clean 3y agoDoes the author have a legitimate reason for having not uploaded anything? I don't see how they're different than any other name squatter, they wanted to reserve the name while not using it. Another person who goes by rbishop wanted to actually use name. From the latter rbishop's perspective, Russ was name squatting his username. Doing a bit of snooping, this post was March 2014, his first interaction on Github was February 2015. So he still didn't do anything on Github for 11 months after the name change.
- crooked-v 3y ago> Does the author have a legitimate reason for having not uploaded anything? Plenty of projects are using GitHub as a social hub. Pushing code isn't the sole use of a username there.
- dymk 3y agoI mean, fair play. If you squat on a username and don't do anything with it for years, having it yoinked seems reasonable. It's not like you paid for it.
- benjaminwootton 3y agoI do actually think this is reasonable. It's really annoying when the handle you want is taken by someone who hasn't used it for years. Two years might be a little short though.
- mbauman 3y agoIt feels a little different if — as it seems to be the case — the GitHub account is used as a static site generator. Heck, the guy could've been depending upon CNAMEing to `rbishop.github.io`.
- deleted 3y ago[deleted]
- NotYourLawyer 3y agoWeird not to notify the original owner and give him a chance to respond though.
- fallat 3y agoYeah I think this is the real issue at hand.
- rand_flip_bit 3y ago> It's not like you paid for it. There are individuals that pay ~$4/month for GitHub Teams, plus other services (Copilot, CI, LFS, Packages, etc). They may not have public repos, but that shouldn't matter.
- paulddraper 3y agoYou are talking about something different.
- deleted 3y ago[deleted]
- notorandit 3y agoThere is no cloud, dude. It is someone else's computer. Deeply buried somewhere it is written they can do anything with your stuff that resides on their computers. Or simply they can do it, then it'll up to you to sue them. Good luck!
- OJFord 3y agoI wonder if they've ever used, or wanted to use, a path or org themselves (like actions, say) that was taken by some external user. Seems a good idea to put user generated content somewhere else, like example.com/users/OJFord instead of top-level say, and then if you decouple handle from displayed name people don't care to claim they're clean name as in OP so much either. But of course for the URL, you have to think of that in your early days - GitHub can't break all those links now!
- not_your_vase 3y agoIf you want your own username, don't use someone else computer. Self-host github/gitlab/gitea/whatev, and use your favorite username, without the fear of losing it.
- tgsovlerkhgsel 3y agoWow. This has pretty terrifying implications if people are using GitHub to sign into other services.
- forgotpwd16 3y agoUsername and user ID are distinct. If username was the ID, you couldn't even change it yourself.
- tgsovlerkhgsel 3y agoThat assumes that all third party sites use the user ID, not the username. From my understanding, the way "login with Github" works is by the app getting an OAuth token, then querying a "give me the currently logged in user" API using that token, which then returns an object identical to https://api.github.com/users/rbishop https://api.github.com/users/rbishop If the client keys on "login" rather than "id" (this GitHub tutorial, for example, only mentions the former, not the latter: https://docs.github.com/en/apps/creating-github-apps/writing-code-for-a-github-app/building-a-login-with-github-button-with-a-github-app https://docs.github.com/en/apps/creating-github-apps/writing...) and then stores "github user rbishop can access account 123456 on our system", the new owner of the account name would likely be able to hijack the previous owner's 3rd party accounts.
- sandaru1 3y agoHow would this affect you if you are using Github as a OAuth provider? Does Github mention under what conditions they are going to take away someone's username? No code? No OAuth? No activity?
- bastardoperator 3y agoMost corps are looking at GH EMU, which means you bring the username/email address, and that a public GH username is not possible. This also prevents the creation of public repositories. https://docs.github.com/en/enterprise-cloud@latest/admin/identity-and-access-management/understanding-iam-for-enterprises/about-enterprise-managed-users https://docs.github.com/en/enterprise-cloud@latest/admin/ide... The people they care about don't use GitHub oauth, but instead use their own private idp like Okta.
- grumple 3y agoThat is troubling. Does this mean Github staff can basically take over any private account without contacting the owners? Can regular staff access private repos? Could they quietly manipulate my own repos by changing my ssh key and pushing commits? Sky's the limit in terms of the negative impact that could have. Does SSO with Github depend on the username? Would a renamed account be able to access services where I used "Sign in with Github"?
- blep_ 3y ago(I don't work at Github, these are inferences from working on other cloud services) > Does this mean Github staff can basically take over any private account without contacting the owners? That's an incredibly common feature to have on the admin side. Three of the four companies I've worked at have had some form of "log in as this user" button, with general guidance to not do anything dumb. The fourth had good reasons for not supporting that, but it made debugging anything happening in production incredibly annoying. > Could they quietly manipulate my own repos by changing my ssh key and pushing commits? They _literally own the servers_. They don't need your ssh key. Likely not _everyone_ has direct filesystem access, but at least a few people do. By hosting anything on a cloud service, you are trusting the people running that service. If you don't trust them, don't do that.
- dkarras 3y agothis happened to me as well. I had repos, I was even approved members of several large scale open source projects. Just did not have to do anything related to GitHub for a few years. Turns out they renamed me and gave my name to someone else upon request. My links to various repos in my github scattered around the internet (with the old username) still works (so I assume, the new owner can't create repos with the same names). Don't know why GitHub goes through all those hoops to allow this to be honest (yes I'm salty). Like if it was just a registration and empty account that is understandable but they renamed an account full of repos and memberships and their infrastructure supports keeping old links active etc. Just weird.
- siva7 3y agoHappened to me also. I had registered my username in the first year Github started. Around 10 years later i discovered that someone else assumed my username through reaching out to their support. I was using Github still actively but hadn’t committed for quite some time in public. I was very pissed when i discovered. Support refused to change my name back instead giving me a coupon i never asked for. Whoever thought at Github this to be a good idea didn’t think through. It’s like the most retarded solution to a problem every social platform faces i’ve seen so far in how it is checked through.
- ZWoz 3y agoI found amusing that IP address in one screenshot has following field in whois: Address: 1800 Bishops Gate Blvd Isn't gate common way to suffix scandals in USA?
- throwboatyface 3y agoBishops Gate has been a place before Watergate happened.
- ZWoz 3y agoSure, Gate is somewhat common way to naming places. Not really related to trouble in article, but nice coincidence, we have Bishops and Gate.
- king_geedorah 3y agoLots of discussion on the name changing portion of this, but I’m more perplexed by the github dev / support adding an SSH key to the account. Obviously they have that kind of access to the data / accounts hosted in their infra, but I don’t really understand why that would have been necessary or why they didn’t remove the key afterwards.
- pbhjpbhj 3y agoSo you make usernamex, username-x, username-xx accounts and populate the repos ... do they then bump you to username-y?
- deceptionatd 3y agoThis seems... deeply idiotic on GitHub's part. Consider the following scenario: 1. A script/CI/etc is pulling the latest releases from the repository. 2. Ownership of the account is changed. 3. The new owner controls the contents of the repository, and can perform a supply chain attack. I'm not sure GitHub would be liable there, but personally I wouldn't want to find out the hard way.