GitHub's email correlation for authorship | Hacker News Reader

GitHub's email correlation for authorship

github.com

43 pointstimf23 comments

This was just me verifying what I saw, that if you push commits to GitHub, it correlates the email address of authors introducing commits elsewhere. You can make it look like anyone you want is contributing patches, the avatar shows up, etc. This example commit does NOT show up in dhh's timeline, though.

I am not going to start requiring PGP signing for my projects, they are not big enough to miss something fishy. This was just something I hadn't considered, it is probably an obvious issue to many already.

That's mostly correct. We use the email addresses provided in the commit Author and Committer fields and correlate them with the email addresses associated with GitHub user accounts. The commit Author/Committer email addresses are also used to fetch gravatar images even when no GitHub user account exists for the email.

It's trivial to spoof these fields using the --author argument to git-commit(1), by setting the GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL environment variables, or by setting a different name/email using git-config(1).

Thanks. So it didn't cross my mind that this was some huge security flaw, I would have reported something like that privately. I hope starting this discussion does not cause any unecessary confusion.

GitHub rocks, it has really changed our contributor attitudes. I am a happy, paying customer (another account) and just really hope you guys are around a long time!

> GitHub rocks, it has really changed the contributor attitudes for my main project, I am a paying customer (another account)

Thanks!

> and just really hope you guys are around a long time!

We'll be here. It's a profitable business with a straightforward model and we intend to keep it that way.

Would you care to elaborate a little? I only understand it partially.

So, you aren't 'dhh' but you commited using his email address and it showed up as him?

It's on a par with using a forged From header over SMTP. You can send e-mail as pretty much anyone. (Though technologies like SPF are helping clamp down on this.)

"Joe jobbing" is when spammers use real e-mail addresses in their From headers so that that person gets the flak. In a round about way, this is the same for patches/commits :-)

He changed his git config so that user.email was david@loudthinking.com (The email DHH lists on GitHub). GitHub then automatically says "oh, this is by david@loudthinking.com, so let's put his avatar there and link to his profile as the author."

Changing the config is as simple as

    git config user.email "david@loudthinking.com"

And you can add a --global flag if you want that to be the default for all repos instead of just the one you're on.

Edit: There's also some way to do it with a --author= flag when you commit.

You have it correct. What you say in your second sentence is exactly the issue.

If this is "actually" a big issue or not is another question.

Sure, all it does is links the commit to a github login. It doesn't somehow give you access to any data that's not yours. You've just discovered another way to post spam.

I would hope people didn't blindly accept patches off of merit anyways, or is there another problem I am missing?

Edit: not to say this shouldn't be fixed I am curious if this implies anything else that I may be missing.

No patch has been accepted (unless I mis-understood what you are saying).

In fact, if it's not totally obvious to everyone that timf is the one that committed the latest commit, then this demonstration is noteworthy.

I was simply stating that patches shouldn't be accepted just because a high profile person submitted it (which this could possible be used to spoof for malicious intent).

As for the second part I was wondering if this had any other implications such as committing to someone else repo or if it is just masking identities with another users.

We could call this "joe patching," named after the similar issue of "joe jobbing." :-)

Might be an issue in that it could be used to damage someone's reputation by spoofing their avatar/etc and then trying to push malicious commits. That's what occurs to me at first glance, anyways.

I'm not really sure why this is an issue at all. Yes, "rogue" repositories could claim that you'd authored various commits. But, why would people be looking at these repos in the first place?

There's a very strong builtin trust mechanism on GitHub — mainly due to the fact that repositories hang off of "users" instead of them hanging off of "projects".

And, myself, when browsing around aimlessly on GitHub, tend to check out either reputable projects (where such behaviour is not likely to go unnoticed) or the repos of a hacker i'm interested in — who surely doesn't have much reason to fake their own commits? ;p

Heh, maybe this could be the basis for a GitHub Reality TV show. "Tonight: DHH fakes his own death!" ;p

Git makes PGP so ridiculously easy to do (as far as unix goes) that it shouldn't be that big of a deal to add the option.

Just like regular mail, e-mail, the bylines on articles, people on the phone, ...

If you don't want people to worry about the integrity of your code, then "git tag -s" to sign a tag. Signing a tag makes it possible to verify the authenticity of the entire branch to that point.

Github has a bunch of security holes.....you'd be surprised what's out there right now....

here's a screenshot from some of my github expliots...

http://i.imgur.com/irL01.png

As I recall, your account got suspended because of this and suddenly became extremely apologetic when you realized you needed your account for work the next day.

There's a big difference between a security hole and acting like a jackass.

if you look at the IRC logs for the day you'll see i specifically warned some employees what i was doing hours before i did it. you'll also see i was instantly unbanned and was making jokes about how my boss would be mad at me if i got banned from github.

i could have easily not been detected doing this. i chose to to spam the site to see how fast it could respond. i got those 2k users in about 3 minutes or so....

I don't get it? It looks just like the "explore" page on github... am I missing something?

the top trending project is a project he created to get to the top of the trending projects list.

The number of watchers on the first repository.

Reply on news.ycombinator.com