Hacker News Reader

Comment by typicalbender | Hacker News Reader

I like the idea Github providing an easier way to gauge momentum on a repository and then maybe do some sorting based on that. I can't tell you how many times i've been looking for a repository and a large number of them come up with no indication, other than number of starts and forks, about whether that is the main repository that is still maintained or not.

View on HN

That could still be gamed by committing a lot if you are a malicious user. I'm sure they could figure out a way that would work but it seems the naive way is Not ideal.

Also remember that you can trivially fake author name, email and date in git and thus github. Only the github-side push log will tell which user pushed what, the commit log can lie all it wants.

Most notably, you can backdate a commit and github won't even show it in the commit log (because it uses strict commit date order).

Yes, but also remember that you'll get loud warnings about non-fast-forwards thanks to the cryptographically secure SHA1 hashes. This means that the repo admins and downstream clones can trivially detect history rewrites for branches they have fetched. Unfortunately, there isn't a good way for code-consumers to tell if and when a non-rewrite commit or branch has been "blessed" by an admin rather than some random committer. I guess this means that the README should make some mention of the collaboration policy and the admins should preserve release power to whatever the relevant package manager is.

You don't need to rewrite history. You just add new commits with fake author & date.

Reply on news.ycombinator.com