6 ms·

> The idea is that you can bring your own account into an enterprise The issues goes beyond authorization. I’ve had Github randomly once in a blue use my perso

by eCa 2y ago

> The idea is that you can bring your own account into an enterprise The issues goes beyond authorization. I’ve had Github randomly once in a blue use my personal email address as the default when merging a work PR. If anyone asks, I advice against mixing personal and professional stuff in the same Github account (or anywhere).

PokestarFan 2y ago
Why not just use the GitHub generated email address you get when you hide your email?
l72 2y ago
My company does not allow any employees to use their personal GitHub for work (or Facebook, instagram, or anything else) after running into issue when employees leave.
- booi 2y ago
  Wouldn’t you just remove them from the org?
  - onionisafruit 2y ago
    They may decide to change their github login to <company_name>LIES, and suddenly that’s all over your old PRs and Issues. Including in public repos where customers go looking for help.
    - TheDong 2y ago
      That's even more true with a dedicated work github account than a mixed personal/work one; either way they can still login and edit the account name even if removed from the company org, and if it's not shared it doesn't burn their personal account too... right? Is this speaking from experience?
      - deleted 2y ago
        [deleted]
      - wlesieutre 2y ago
        With a dedicated work account the organization can always take over the account (via reset email if need be, since they own your work email account) and do whatever they want with it
        rendaw 2y ago
        A dedicated work account _where you use your work email address_... that was the missing part throughout this thread. But then if you do that you also lose all your open source work history, which is important from a hiring/resume perspective.
        cdogl 2y ago
        One option for those so inclined is to cryptographically sign commits with a key that lists both work and personal email address (assuming your enterprise’s policy allows it). The employer retains control but you have a claim to credit for your work.
        tsimionescu 2y ago
        If we're discussing companies willing to go to lengths to scrub you from their GitHub history, they can still replace all commits you've signed with new commits. You likely have no legal rights to that work, and git does allow you to rewrite history arbitrarily.
        shiomiru 2y ago
        > git does allow you to rewrite history arbitrarily. Technically yes, but the price is too great - everybody who has cloned the repos will now have to nuke their local copies too.
        2y ago
nextts 2y ago
Yeah someone said why the funny account name why not use your personal account and I thought "wat are you crazy". And that isn't because of SAML etc. just simple don't mix work and pleasure ethos! I don't use my personal email to send an email to a customer.
- mjevans 2y ago
  Funny that, exactly why NOWHERE should consider a phone number any form of ID.
  - tsimionescu 2y ago
    Can you elaborate on the connection you see here?
    - mjevans 2y ago
      Tying someone's identity to a thing they barely control and find it difficult to get more than one of. Particularly something someone might reasonably need 3 or more different instances of. E.G. Personal SemiProfessional, Personal NSFW stuff, Work but they didn't give an X this service demands.
- freeopinion 2y ago
  It seems to be very common to use a personal phone for work 2fa or lots of other workplace tasks. Employers seem mystified if you request a corporate device when you obviously already have your own. I even see this a little with personal vehicles. The idea of separating work and personal seems to be becoming old-fashioned.
whyever 2y ago
Using more than one Github account violates their ToS though.
- _cenw 2y ago
  You may notice the button with the two opposing arrows on top of the user menu. You should click on it.
MortyWaves 2y ago
This is exactly why I’m so paranoid about account and device separation. I don’t even trust Git profiles. I buy a new license for GitKraken at any job I go to, even if I could avoid it; to me the possibility of accidentally trying to commit to work GitHub with my personal GitHub or vice verse is not worth it. It’s the same with Microsoft accounts and their infamously bad-tech-debt-caused spaghetti. Like if you try login to Outlook on iOS and you get a threatening message to the effect of “your system administrator will be able to remotely control and wipe your entire device if you proceed”. If it’s even a possibility that an incompetent or malicious IT department wipes your personal device, then no thank you. See also that HN thread where a father let his child use his laptop, where they signed into their Microsoft school account, and somehow his personal Microsoft account was merged into their school account and from what I could tell he was never able to fix it and the school IT department didn’t care.
- cyberpunk 2y ago
  Depends on the org I think now the controls are more fine grained. For example I have teams and outlook on my personal phone and the only thing they can do is delete the apps, taking a screenshot is blank, copy/paste doesn’t work etc.
  - deergomoo 2y ago
    MAM vs MDM. MAM is good when you want your developers to be reachable on Slack but they all (for good reason) refuse to install an MDM on a personal device—at least that seems to be how my employer feels.
- soco 2y ago
  Not only on iOS, also Outlook on Android does the same. Ironically, Teams doesn't try the same trick, so if they have some emergency while I'm away, my folks know to only try sending me stuff in Teams, as Outlook will never be installed here.
TheNewsIsHere 2y ago
GitHub is my current go-to example of an individual oriented application with business features shoehorned into it. For awhile GitHub was rather unavoidably the only place in my company where there was no reliable line between personal and professional accounts/systems. I moved us to Forgejo after trialing it against Github (and GitLab, and Gitea). At a prior employer everyone just used their personal GitHub accounts for the business. Once it became a “capital-E-Enterprise” making promises about things like employee SSO, they quickly retreated to an on-premise platform (not GitHub EE).

by eCa 2y ago

PokestarFan 2y ago

Why not just use the GitHub generated email address you get when you hide your email?

l72 2y ago

My company does not allow any employees to use their personal GitHub for work (or Facebook, instagram, or anything else) after running into issue when employees leave.

booi 2y ago
Wouldn’t you just remove them from the org?
- onionisafruit 2y ago
  They may decide to change their github login to <company_name>LIES, and suddenly that’s all over your old PRs and Issues. Including in public repos where customers go looking for help.
  - TheDong 2y ago
    That's even more true with a dedicated work github account than a mixed personal/work one; either way they can still login and edit the account name even if removed from the company org, and if it's not shared it doesn't burn their personal account too... right? Is this speaking from experience?
    - deleted 2y ago
      [deleted]
    - wlesieutre 2y ago
      With a dedicated work account the organization can always take over the account (via reset email if need be, since they own your work email account) and do whatever they want with it
      - rendaw 2y ago
        A dedicated work account _where you use your work email address_... that was the missing part throughout this thread. But then if you do that you also lose all your open source work history, which is important from a hiring/resume perspective.
        cdogl 2y ago
        One option for those so inclined is to cryptographically sign commits with a key that lists both work and personal email address (assuming your enterprise’s policy allows it). The employer retains control but you have a claim to credit for your work.
        tsimionescu 2y ago
        If we're discussing companies willing to go to lengths to scrub you from their GitHub history, they can still replace all commits you've signed with new commits. You likely have no legal rights to that work, and git does allow you to rewrite history arbitrarily.
        shiomiru 2y ago
        > git does allow you to rewrite history arbitrarily. Technically yes, but the price is too great - everybody who has cloned the repos will now have to nuke their local copies too.
        2y ago

nextts 2y ago

Yeah someone said why the funny account name why not use your personal account and I thought "wat are you crazy". And that isn't because of SAML etc. just simple don't mix work and pleasure ethos! I don't use my personal email to send an email to a customer.

mjevans 2y ago
Funny that, exactly why NOWHERE should consider a phone number any form of ID.
- tsimionescu 2y ago
  Can you elaborate on the connection you see here?
  - mjevans 2y ago
    Tying someone's identity to a thing they barely control and find it difficult to get more than one of. Particularly something someone might reasonably need 3 or more different instances of. E.G. Personal SemiProfessional, Personal NSFW stuff, Work but they didn't give an X this service demands.
freeopinion 2y ago
It seems to be very common to use a personal phone for work 2fa or lots of other workplace tasks. Employers seem mystified if you request a corporate device when you obviously already have your own. I even see this a little with personal vehicles. The idea of separating work and personal seems to be becoming old-fashioned.

whyever 2y ago

Using more than one Github account violates their ToS though.

_cenw 2y ago
You may notice the button with the two opposing arrows on top of the user menu. You should click on it.

MortyWaves 2y ago

This is exactly why I’m so paranoid about account and device separation. I don’t even trust Git profiles. I buy a new license for GitKraken at any job I go to, even if I could avoid it; to me the possibility of accidentally trying to commit to work GitHub with my personal GitHub or vice verse is not worth it. It’s the same with Microsoft accounts and their infamously bad-tech-debt-caused spaghetti. Like if you try login to Outlook on iOS and you get a threatening message to the effect of “your system administrator will be able to remotely control and wipe your entire device if you proceed”. If it’s even a possibility that an incompetent or malicious IT department wipes your personal device, then no thank you. See also that HN thread where a father let his child use his laptop, where they signed into their Microsoft school account, and somehow his personal Microsoft account was merged into their school account and from what I could tell he was never able to fix it and the school IT department didn’t care.

cyberpunk 2y ago
Depends on the org I think now the controls are more fine grained. For example I have teams and outlook on my personal phone and the only thing they can do is delete the apps, taking a screenshot is blank, copy/paste doesn’t work etc.
- deergomoo 2y ago
  MAM vs MDM. MAM is good when you want your developers to be reachable on Slack but they all (for good reason) refuse to install an MDM on a personal device—at least that seems to be how my employer feels.
soco 2y ago
Not only on iOS, also Outlook on Android does the same. Ironically, Teams doesn't try the same trick, so if they have some emergency while I'm away, my folks know to only try sending me stuff in Teams, as Outlook will never be installed here.

TheNewsIsHere 2y ago

GitHub is my current go-to example of an individual oriented application with business features shoehorned into it. For awhile GitHub was rather unavoidably the only place in my company where there was no reliable line between personal and professional accounts/systems. I moved us to Forgejo after trialing it against Github (and GitLab, and Gitea). At a prior employer everyone just used their personal GitHub accounts for the business. Once it became a “capital-E-Enterprise” making promises about things like employee SSO, they quickly retreated to an on-premise platform (not GitHub EE).