7

I'm learning how to use Git, and I've noticed that there's no control over the user.name and user.email when commiting. For example, I'm inside my repository. I can change my local config,

$ git config user.name "<someone's Github username>"
$ git config user.email "<someone's Github email>"

Then, I commit something and push it. I will be asked for my Github username and password.

Now it appears as if that another Github user authored that commit in my repository. !?

Am I missing something?

1
  • Note that you can sign your commits, which proves that you were indeed the author of that commit. You can also configure your repo to require that all commits are signed.
    – FWDekker
    Jan 23 at 8:34

2 Answers 2

6

Wow this is an excellent question I don't understand why this hasn't gotten more attention (Maybe because it's not exactly security related than SU).

There is a hacker news discussion about it - https://news.ycombinator.com/item?id=7792026

This is not a major issue but you could do some serious abuse with it -

  1. You can publish commits from famous people making it look like they endorse your project and actively contribute to it.
  2. You can fake the amount of contributors your project actually has by using multiple identities of other real GitHub users. (this will look way more legit than just using random e-mails)
  3. You might be able to convince someone to merge a pull request into his project by making him think most commits are coming from another trusted user

Recently GitHub been criticized for also allowing project owners to edit comments of users replying in their project making it look like they wrote stuff they didn't write which can lead to serious abuse. This is a very similar thing.

As other answers has mentioned this is how Git was designed. in an internal repo you don't care much about this stuff and you mostly care about managing code and not reputation. GitHub on the other way is a social tool and should care about its user public reputation (as mentioned in the hacker news discussion this solvable by PK encryption. many users already have PK assigned to their GitHub account for push permissions I would imagine same key can be used to sign commits )

2

Git has no way to know who authored what. How could it know? All it's doing is reporting what you tell it to report. Garbage in, garbage out.

It is absolutely normal and routine for one person to commit another person's work.

4
  • Well, it’s normal for them to push it, not commit it. ;) There are exceptions, like cherry picks. They are properly annotated, however.
    – Daniel B
    Sep 24, 2014 at 21:12
  • But if I commit and push something into my repository as if it was an important programmer in Github, nobody knows if it's true or not. He isn't even notified. Sep 24, 2014 at 21:26
  • @redraw That's correct. But everyone knows that it's just a claim that that important programmer authored the change -- a claim made by someone authorized to make such claims for that repository. Sep 24, 2014 at 21:29
  • @redraw Consider the flipside: Say the change is authored by that super important person, but they're way too important and busy to commit it to this particular repository. Someone authorized to commit to this repository has to commit it, and they should be able to identify the actual author. Otherwise, how do you track other people's changes? Of course he's not notified -- he's super important and you're nobody. Why should he care what you do in some repository he doesn't care about? You can put whatever nonsense you want in your own repository and nobody should have to approve or care. Sep 24, 2014 at 21:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .