Hacker News Reader

Comment by nostrademons | Hacker News Reader

Or just push it to GitHub. Git records the author of each commit with it, assuming you've set up your .gitconfig correctly. In the absence of a contract stating otherwise, copyright remains with the person who wrote each part of the work. 'git blame' will show exactly who wrote what. GitHub gives you a third-party, subpoenable, record of who committed when.

View on HN

Can you give me a reason for "subpoenable" as a requirement? I mean wouldn't the github data be authoritative and easy to check? Or do we really need to be forcing githubs lawyers to get involved to provide answers to a subpoena if there's a lawsuit?

Anyway, you make a great point about the commits being clear assignment of copyright, and thanks for that!

The subpoenable requirement is because you can rewrite history in git. If you just have a local copy of a repository on your hard disk, your opponent's lawyers might argue "Well, you might have used git commit --amend or manually altered the bits of the repository", and you can't show otherwise. Once you push to GitHub, the repository has become public, and a copy exists somewhere where you can't just manually alter the bits or run git commit --amend.

You don't have to actually subpoena GitHub and get their lawyers involved. The fact that you can means that opposing council will know that you're not bluffing or lying when you say "I authored this commit, and I have the commit logs to prove it". Or if they think you are bluffing or lying, they can certainly subpoena GitHub themselves...but if you aren't, that works in your favor.

To be fair the commit time and the authorship time are not the same. You can author something at work and wait to get home to commit it and vice versa.

Yeah, you can, but that's more of an issue when proving "Does my employer own my work or do I?" For the startup weekend case, time doesn't matter, you only need to prove authorship - and while a git commit that says "Bobby Boyd <rboyd@gmail.com>" doesn't necessarily mean Bobby Boyd wrote it, that plus Bobby Boyd saying he wrote it, plus a GitHub log showing that the authorship attribution hasn't been tampered with, is pretty good evidence that he wrote it. If Billy NoLastName had written it, why didn't he claim credit for it when he pushed it?

> plus a GitHub log showing that the authorship attribution hasn't been tampered with

Unless Github has some backup logs somewhere, that entire log can be wiped out and replaced with whatever someone wants with a simple `git push -f`.

Which is why it's so important to sign commits. You sign your commits, and keep your private key private, and as long as any copy of the repo exists anywhere you can access, you can prove authorship/ownership.

Commit signing is also very useful for vouching for code integrity.

You still can't prove authorship. You can prove that at some point you signed that particular commit. But I could easily take a repo including signed commits from you and rewrite and resign the commits with my own private key. This only works if the one doing the signing is a trusted third party.

That's a good point, but if you combine signing with an indelible timestamp, like one of the blockchain services or other trusted legal timestamping services, you'd be in pretty good shape.

I assume you're suggesting something like including such a timestamp in the commit message? If that's the case, that makes a lot of sense to me. It would be cool to have a tool to automate this. Or something like GitTorrent[0] might do the trick if it had wider adoption.

[0] http://blog.printf.net/articles/2015/05/29/announcing-gittor...

(Sorry for late response.)

No, for this to work, you'd really need to timestamp either the git tree hash or (preferably) the hash of the GPG signature (or the signature itself).

Most timestamp service hashes are necessarily public (for trust reasons), so an attacker could grab one and go back and include it in his signed commit message.

But if you timestamp your commit hash (which is a cryptographic hash after all -- albeit an increasingly weak one) or timestamp the signed commit, then it can't be forged (since the attacker can't go back in time and use a cryptographically-verifiable timestamp, like the ones indelibly embedded in the blockchain).

Sorry, what I meant was to include a hash of the commit in a public blockchain and then attach this timestamp to the commit. So I think we're on the same page.

I assume GitHub has backup logs of all activity somewhere, if only to prevent the "Somebody guessed my GitHub password and replaced all my repositories with a README saying 'HAHA U BEEN PWNED!', please help!" situation.

Reply on news.ycombinator.com