6 ms·

Remember: your git commit email is public

55 points by davefp 13y ago

vsbuffalo 13y ago
See Github's setup tip on configuring a fake email address: https://help.github.com/articles/keeping-your-email-address-private https://help.github.com/articles/keeping-your-email-address-...
- davefp 13y ago
  Thanks for the link, I've updated the post :)
obviouslygreen 13y ago
Definitely made me laugh at myself, as I certainly hadn't thought about this... after the initial "oh crap" moment, further analysis revealed that I don't particularly care. Today's new thing has been learned.
jefe78 13y ago
I tried sending you an email but there seems to be a problem with the MX record associated with your domain. Mail is being rejected.
- davefp 13y ago
  Oops. Thanks for the heads up on the DNS issue. Should be fixed now. I'll respond to your email shortly.
  - jefe78 13y ago
    No worries. Happens to the best of us! Looking forward to your reply. Sorry about the forwardness of it.
- jon-wood 13y ago
  I guess that's one way of dealing with the problem...
remi 13y ago
Correction: your git commit email (used in public repositories) is public.
- davefp 13y ago
  Yes, indeed. That's an important clarification.
lifthrasiir 13y ago
I don't mind particularly whether my email is public or not, but it is definitely useful to know how the sender knew/collected my email address. For that purpose I'm using two addresses: public+{hg,git} at my domain. I have bunches of other addresses of the form pubilc+<service> at my domain, and some of the form public.<service> at my domain (as <service> stupidly refused to accept an email address with +).
- asperous 13y ago
  Some spammy things throw away the + because they know they are optional. Having your own domain is nice because you can set it up to make <anything>@yourdomain.com work.
  - lifthrasiir 13y ago
    Actually I do. ;) Also, public at my domain is separate from my "official" email addresses so I can reasonably expect emails from public at my domain are results of automatic crawling.
    - asperous 13y ago
      Smart!
marssaxman 13y ago
Uh, no. Git commit messages which are stored in public repositories such as Github are public, because public repositories are public. Git commit messages which are stored in private repositories are private. Git commit messages have the same access restrictions as the repositories which contain them. Duh?
- davefp 13y ago
  Absolutely. I should probably have clarified that. I do think there's a disconnect between which pieces of data people think are public vs. what is actually public. My git commit email was one of them. That's what I'm trying to illustrate in my post.
  - marssaxman 13y ago
    Gotcha. Fair enough. Perhaps I shouldn't have said "duh".
    - MartinCron 13y ago
      Perhaps I shouldn't have said "duh" That's almost always correct :)
      - Dylan16807 13y ago
        I don't know, 'duh' is a good term for that feeling when you realize something you should have realized a long time ago.
rmk2 13y ago
I think this brings up a good point, not just regarding git, but also in general. I noticed something similar also for my dotfiles. My emacs config has my full name and email address (whereas the email address also includes the full name, again) in it (whereas my git commits use another, less directly connected name). It doesn't really have to do with excessive paranoia (and by all means, it's not that hard to get to a full name from either address), but these are the small places where I tend to forget that information will (or: would) thus ultimately end up in public.
cinquemb 13y ago
You can also access the links using digits ex.[https://api.github.com/users/6/events/public https://api.github.com/users/6/events/public], so I could see someone running easily mining each page for email addresses and names for their recruiting bot… pretty interesting stuff.
artagnon 13y ago
git was built for linux.git. A tool for developers on the linux community to collaborate. Ofcourse the email ID is public: if someone finds a bug, they should be able to send a patch to the maintainer right away. Please don't use fake email ids. That defeats the whole purpose of open source. Ofcourse, if you are working on something closed source, the email ids aren't public by definition; those git repository aren't public.
- mcintyre1994 13y ago
  I don't think this is really an issue any more, even Linux itself has its source on Github now. There's almost certainly alternative, arguably better ways of contacting the maintainer of a public repository now.
benatkin 13y ago
Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So you'd better make sure you pick one that you're in control of. Unless you ignore the confirmation email that gets sent to you. If you already have an email address in your GitHub account that you want to use for the purpose of linking commits but don't want to be usable for resetting passwords, and you've already verified it, you can delete the email address and then just add it back, and then delete the verification email that gets sent. I've written to GitHub twice, once to their support address and once to their security address about it and they were pretty middle-of-the-road about it. But twitter has a big issue with fraudulent password resets so I wish they'd make it so only the primary email can be used for password resets, or provide a way to say which email addresses can be used for password resets.
- socillion 13y ago
  > Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So you'd better make sure you pick one that you're in control of. I just tested it and successfully reset my password without ever verifying the new email address - so it's an open invitation for someone to hijack your account if you don't control the fake one. Beats me what the purpose of the verification is.
  - benatkin 13y ago
    Also at least one of GitHub's employees has an email address from a company that he used to work for. This just shows that not everyone who signs up for GitHub uses an email address that's under their control. https://github.com/github/linguist/commit/99c296264ab320d41c6737b679cb57e005ed2ffa.patch https://github.com/github/linguist/commit/99c296264ab320d41c...
    - socillion 13y ago
      Correction: it's actually only possible to use an unverified email to reset the password if you don't have any verified emails on the account. Not as bad as I thought, but it still seems a bit questionable.
signed0 13y ago
This seems like a great way for a recruiter to alienate someone they are hoping to recruit. Last month a recruiter was able to get my email address me through this very mechanism. It immediately felt slimy to me and completely put me off the companies they were recruiting for. If this becomes widespread people will start clocking their git commit email in the same way that they cloak their DNS email records.
ar4s 13y ago
wow... any chance this is the reason I've suddenly started getting pounded with "work in america!" emails? (I'm Canadian, and probably not the demographic they are trying to target)

55 points by davefp 13y ago

See Github's setup tip on configuring a fake email address: https://help.github.com/articles/keeping-your-email-address-private https://help.github.com/articles/keeping-your-email-address-...

davefp 13y ago
Thanks for the link, I've updated the post :)

obviouslygreen 13y ago

Definitely made me laugh at myself, as I certainly hadn't thought about this... after the initial "oh crap" moment, further analysis revealed that I don't particularly care. Today's new thing has been learned.

jefe78 13y ago

I tried sending you an email but there seems to be a problem with the MX record associated with your domain. Mail is being rejected.

davefp 13y ago
Oops. Thanks for the heads up on the DNS issue. Should be fixed now. I'll respond to your email shortly.
- jefe78 13y ago
  No worries. Happens to the best of us! Looking forward to your reply. Sorry about the forwardness of it.
jon-wood 13y ago
I guess that's one way of dealing with the problem...

remi 13y ago

Correction: your git commit email (used in public repositories) is public.

davefp 13y ago
Yes, indeed. That's an important clarification.

lifthrasiir 13y ago

I don't mind particularly whether my email is public or not, but it is definitely useful to know how the sender knew/collected my email address. For that purpose I'm using two addresses: public+{hg,git} at my domain. I have bunches of other addresses of the form pubilc+<service> at my domain, and some of the form public.<service> at my domain (as <service> stupidly refused to accept an email address with +).

asperous 13y ago
Some spammy things throw away the + because they know they are optional. Having your own domain is nice because you can set it up to make <anything>@yourdomain.com work.
- lifthrasiir 13y ago
  Actually I do. ;) Also, public at my domain is separate from my "official" email addresses so I can reasonably expect emails from public at my domain are results of automatic crawling.
  - asperous 13y ago
    Smart!

marssaxman 13y ago

Uh, no. Git commit messages which are stored in public repositories such as Github are public, because public repositories are public. Git commit messages which are stored in private repositories are private. Git commit messages have the same access restrictions as the repositories which contain them. Duh?

davefp 13y ago
Absolutely. I should probably have clarified that. I do think there's a disconnect between which pieces of data people think are public vs. what is actually public. My git commit email was one of them. That's what I'm trying to illustrate in my post.
- marssaxman 13y ago
  Gotcha. Fair enough. Perhaps I shouldn't have said "duh".
  - MartinCron 13y ago
    Perhaps I shouldn't have said "duh" That's almost always correct :)
    - Dylan16807 13y ago
      I don't know, 'duh' is a good term for that feeling when you realize something you should have realized a long time ago.

rmk2 13y ago

I think this brings up a good point, not just regarding git, but also in general. I noticed something similar also for my dotfiles. My emacs config has my full name and email address (whereas the email address also includes the full name, again) in it (whereas my git commits use another, less directly connected name). It doesn't really have to do with excessive paranoia (and by all means, it's not that hard to get to a full name from either address), but these are the small places where I tend to forget that information will (or: would) thus ultimately end up in public.

cinquemb 13y ago

You can also access the links using digits ex.[https://api.github.com/users/6/events/public https://api.github.com/users/6/events/public], so I could see someone running easily mining each page for email addresses and names for their recruiting bot… pretty interesting stuff.

artagnon 13y ago

git was built for linux.git. A tool for developers on the linux community to collaborate. Ofcourse the email ID is public: if someone finds a bug, they should be able to send a patch to the maintainer right away. Please don't use fake email ids. That defeats the whole purpose of open source. Ofcourse, if you are working on something closed source, the email ids aren't public by definition; those git repository aren't public.

mcintyre1994 13y ago
I don't think this is really an issue any more, even Linux itself has its source on Github now. There's almost certainly alternative, arguably better ways of contacting the maintainer of a public repository now.

benatkin 13y ago

Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So you'd better make sure you pick one that you're in control of. Unless you ignore the confirmation email that gets sent to you. If you already have an email address in your GitHub account that you want to use for the purpose of linking commits but don't want to be usable for resetting passwords, and you've already verified it, you can delete the email address and then just add it back, and then delete the verification email that gets sent. I've written to GitHub twice, once to their support address and once to their security address about it and they were pretty middle-of-the-road about it. But twitter has a big issue with fraudulent password resets so I wish they'd make it so only the primary email can be used for password resets, or provide a way to say which email addresses can be used for password resets.

socillion 13y ago
> Also your git commit email needs to be added to your GitHub account for it to link to your GitHub account. And then it can be used to reset your passwords. So you'd better make sure you pick one that you're in control of. I just tested it and successfully reset my password without ever verifying the new email address - so it's an open invitation for someone to hijack your account if you don't control the fake one. Beats me what the purpose of the verification is.
- benatkin 13y ago
  Also at least one of GitHub's employees has an email address from a company that he used to work for. This just shows that not everyone who signs up for GitHub uses an email address that's under their control. https://github.com/github/linguist/commit/99c296264ab320d41c6737b679cb57e005ed2ffa.patch https://github.com/github/linguist/commit/99c296264ab320d41c...
  - socillion 13y ago
    Correction: it's actually only possible to use an unverified email to reset the password if you don't have any verified emails on the account. Not as bad as I thought, but it still seems a bit questionable.

signed0 13y ago

This seems like a great way for a recruiter to alienate someone they are hoping to recruit. Last month a recruiter was able to get my email address me through this very mechanism. It immediately felt slimy to me and completely put me off the companies they were recruiting for. If this becomes widespread people will start clocking their git commit email in the same way that they cloak their DNS email records.

ar4s 13y ago

wow... any chance this is the reason I've suddenly started getting pounded with "work in america!" emails? (I'm Canadian, and probably not the demographic they are trying to target)