6

I'm learning how to use Git, and I've noticed that there's no control over the user.name and user.email when commiting. For example, I'm inside my repository. I can change my local config,

$ git config user.name "<someone's Github username>"
$ git config user.email "<someone's Github email>"

Then, I commit something and push it. I will be asked for my Github username and password.

Now it appears as if that another Github user authored that commit in my repository. !?

Am I missing something?

5

Wow this is an excellent question I don't understand why this hasn't gotten more attention (Maybe because it's not exactly security related than SU).

There is a hacker news discussion about it - https://news.ycombinator.com/item?id=7792026

This is not a major issue but you could do some serious abuse with it -

  1. You can publish commits from famous people making it look like they endorse your project and actively contribute to it.
  2. You can fake the amount of contributors your project actually has by using multiple identities of other real GitHub users. (this will look way more legit than just using random e-mails)
  3. You might be able to convince someone to merge a pull request into his project by making him think most commits are coming from another trusted user

Recently GitHub been criticized for also allowing project owners to edit comments of users replying in their project making it look like they wrote stuff they didn't write which can lead to serious abuse. This is a very similar thing.

As other answers has mentioned this is how Git was designed. in an internal repo you don't care much about this stuff and you mostly care about managing code and not reputation. GitHub on the other way is a social tool and should care about its user public reputation (as mentioned in the hacker news discussion this solvable by PK encryption. many users already have PK assigned to their GitHub account for push permissions I would imagine same key can be used to sign commits )

2

Git has no way to know who authored what. How could it know? All it's doing is reporting what you tell it to report. Garbage in, garbage out.

It is absolutely normal and routine for one person to commit another person's work.

  • Well, it’s normal for them to push it, not commit it. ;) There are exceptions, like cherry picks. They are properly annotated, however. – Daniel B Sep 24 '14 at 21:12
  • But if I commit and push something into my repository as if it was an important programmer in Github, nobody knows if it's true or not. He isn't even notified. – whitenoisedb Sep 24 '14 at 21:26
  • @redraw That's correct. But everyone knows that it's just a claim that that important programmer authored the change -- a claim made by someone authorized to make such claims for that repository. – David Schwartz Sep 24 '14 at 21:29
  • @redraw Consider the flipside: Say the change is authored by that super important person, but they're way too important and busy to commit it to this particular repository. Someone authorized to commit to this repository has to commit it, and they should be able to identify the actual author. Otherwise, how do you track other people's changes? Of course he's not notified -- he's super important and you're nobody. Why should he care what you do in some repository he doesn't care about? You can put whatever nonsense you want in your own repository and nobody should have to approve or care. – David Schwartz Sep 24 '14 at 21:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.