How to take credit for someone else's work on GitHub

I do see a point in it working like it does, though. I&#x27;m one of the lead developers on a free software project with over 20 years of history. Even though the project has used multiple version control systems (and hosting providers) over time, we have imported our entire project&#x27;s history going back to the very first commit into git and GitHub.<p>Not every contributor has kept their email address for over 20 years. Some don&#x27;t have access to the old addresses they once used for commits. Still they want the commits to be associated with their current GitHub account; even if it&#x27;s just for statistics and &quot;bragging rights&quot;.<p>If GitHub required email address verification, how would this be done?<p>EDIT: To be clear: With &quot;working like it does&quot; I&#x27;m referring to the possibility to add unverified email addresses to your account and have commits attributed to you.

In spite of GitHub&#x27;s claims that nothing wrong, something <i>is</i> wrong and fixable.<p>GitHub should be showing the identity pulled from the e-mail address, and not replacing it with the name of an associated GitHub account. Just like it does when there is no associated GH account.<p>A reasonable compromise would be to show that name, but turn it into a link to the account if there is one. Then only someone curious clicking on &quot;Linus Torvalds&quot; would see: hey, how come this leads to some VanTudor account?

GitHub’s response is pretty surprising. How can anyone think this is expected? Having to follow Git’s commit message emails makes sense and indeed anybody can use any email they want to make a commit. But then for GitHub to make the connection between (unverified) commit emails and (unverified) GitHub.com accounts is the issue for me. Since they can’t verify the commit email belongs to a GitHub account, why show that as though it were true?

I thought this might be something different. Have seen this happen multiple times over the years - even once just last week.<p>Colleague files an issue with a PR. Project owners close it, say &#x27;no, not a bug&#x27;, then... commits the same thing themselves as &quot;fixed!&quot;. Saw this years before in cvs&#x2F;svn, and... at least in the GH world there&#x27;s some evidence of the original PR author having done the work in the first place (vs being invisibly cut out).

Or you can just do this: <a href="https:&#x2F;&#x2F;github.com&#x2F;bhargavchippada&#x2F;forceatlas2&#x2F;commit&#x2F;7438e2e48347a70d6ebd0bafcca22aea86629a79" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bhargavchippada&#x2F;forceatlas2&#x2F;commit&#x2F;7438e2...</a>

I have used emails in the past I can no longer verify, so I see a use case for linking unverified emails to profiles if there&#x27;s only one profile claiming the email address<p>However, if another profile verified that email address, it definitely shouldn&#x27;t link to another profile that hasn&#x27;t verified

It seems that one proper solution could be:<p>1 - Don&#x27;t associate the commit to an account if the email is unverified, obviously<p>2 - If someone tries to &quot;forge&quot; ownership by pushing a commit with an e-mail that doesn&#x27;t belong to the GitHub account being used to push, a &quot;unverified&quot; warning should be added to the commit and manually claimed by the account owning said e-mail for its status to change.

Veering off topic but I absolutely hate that git requires you to have an &quot;email address&quot; (which cannot be empty and iirc must satisfy some regex criteria for a valid-looking address). A particular choice of user identifier or communication medium should not be hardcoded into the totally unrelated concern of source-control, IMO. Anonymous and non-email accounts should be first-class things. Instead of email maybe you&#x27;d want to have your public-key or something.

I scrolled through all the comments and didn’t see this answer.<p>What better way to recruit famous people to your platform than to allow people to trivially claim their commits until and unless they join and claim them?<p>It is most likely driven by customer acquisition — hence the response “working as expected!”

I remember when one of our contractors refused to do a rebase for like, a week, and just ignored any messages we sent him. I changed my e-mail on git to his, rebase, push, PR merged :)<p>Nobody ever found out hahaha

I remember this earlier subthread where someone was criticizing GitHub for allowing this (even using Torvald as someone to impersonate!), and others offered some defenses (which were IMHO dubious):<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21025378" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21025378</a><p>Also, semi-related, obligatory mention of my joke utility for stealing credit for someone else&#x27;s work:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;silasx&#x2F;git-upstage" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;silasx&#x2F;git-upstage</a><p>Finally, I thought this phrasing was funny, like commits have a non-substantively transferable ownership, like an NFT (though FYI it&#x27;s quoting an older discussion of the same problem):<p>&gt;Someone wrote about the whole situation on Medium in November 2021: &quot;The 1st commit of git&#x2F;git no longer belongs to Linus Torvalds&quot;.

Could someone also write bad code and commit it using someone else&#x27;s email address in the commit message, thus making the commit link to the other person&#x27;s Github profile? (Sort of the reverse problem -- &quot;giving blame&quot; instead of &quot;taking credit&quot;)

Arpad, your site looks like this - <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;jj9Uxbl.png" rel="nofollow">https:&#x2F;&#x2F;i.imgur.com&#x2F;jj9Uxbl.png</a><p>Not just the linked page, the homepage too. All but illegible. That&#x27;s in a recent Firefox on Windows. Just FYI.

Their response is to add a PGP key. But AFAICT they don&#x27;t do verification on PGP keys either. So you could do the same.

I noticed that arraypad is really trying to push his repography project. Whilst this is not a bad thing, it seems like he is using the blog posts as an excuse to push more his project.<p>I don&#x27;t mind that much, but I think I&#x27;ve seen these posts hitting the front page quite a lot already - it&#x27;s a good strategy but it could be maybe against the guidelines:<p>&gt; Please don&#x27;t use HN primarily for promotion. It&#x27;s ok to post your own stuff occasionally, but the primary use of the site should be for curiosity.

This reminds me very much of a &quot;hack&quot; I performed in a workplace that used Outlook&#x2F;Exchange as its primary email system. I simply sent an email (to a few, trusted people) with the &quot;from&quot; field set to the CEO&#x27;s name&#x2F;address.<p>In their inbox it looked completely legit. Outlook even put the CEO&#x27;s avatar next to it and everything. They were genuinely shocked. Even after I explain that the &quot;from&quot; field is just like me writing &quot;love from Mum&quot; at the bottom of a letter I think they still couldn&#x27;t believe it.<p>There is a problem with people assuming that all data they find is authoritative. People don&#x27;t question whether they can trust data often enough. Another problem is when you make things look nice enough, they look trustworthy. This is a well known confidence trick, of course.<p>My PhD supervisor objected to me typesetting my work in LaTeX before it had been checked because he said once it&#x27;s typeset it <i>looks</i> correct, but might still be complete rubbish.<p>Unfortunately this all boils down to web-of-trust, as usual. We&#x27;ve had the solution for decades now, but we&#x27;ve collectively agreed that it&#x27;s more trouble than it&#x27;s worth. So these kinds of problems will keep popping up again and again.

Why not add a small orange (!) icon next to the name for unverified emails, or a similar indicator? As a way of saying &quot;this user claimed authorship, but we couldn&#x27;t verify it&quot;.<p>When you commit from the Github page itself, a similar green &quot;verified&quot; check is shown, but if you do it from command line and then push nothing is shown. So the infrastructure for special verifications messages is there, and perhaps could be used.

I&#x27;m not entirely sold on the explanation &quot;This is just how git commit (messages) work&quot;. GitHub could easily limit linking the GitHub profile to profiles whose e-mail address has been verified (by usual means, no GPG required).<p>They could show statistics and attribution limited to the data available in the commit messages (e.g. accumulated statistics by e-mail address) for contributors without a GitHub profile.<p>Am I missing something here? (Edit: just read the other comments addressing the use cases)

I knew about the ability to push commits as someone else, but GitHub allowing taking ownership of other people&#x27;s commits in their own repos, using an <i>unverified</i> e-mail address seems like a whole another level of insecurity here.<p>Even though git -&gt; email link is weak for reasons beyond GitHub&#x27;s control, I expected email -&gt; github account link to be reliable, since that is entirely under GitHub&#x27;s control.<p>I think GitHub is needlessly making a bad situation even worse here.

Dated back to at least 2015 <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10005577" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=10005577</a><p>It’s old news.

This is just a fact of how attribution works in Git. It&#x27;s not GitHub&#x27;s responsibility to figure out exactly who should be given credit for which commit, they&#x27;re just a viewer on top of Git commits.<p>Imagine you did some work at some workplace years ago, and you want credit for it. You don&#x27;t have access to that email anymore, but you&#x27;d still like to have the credit and have it link to your account. That&#x27;s the usecase.

I&#x27;m extremely surprised as well. This seems like a obvious vector for an impersonation attack. A malicious user could do this, then perhaps they would have more success submitting a malicious change to &quot;correct a flaw in their previous commit&quot;<p>At the very least, repo owners should have some better control over how attributions display when the user is not a project member or the email used is not verified to an existing user.

Repography looks very cool, but why does it need permission to &quot;act on my behalf&quot;?<p>Is it possible to use without connecting my user at all?

An obvious and feasible improvement is to least make it clear in the UI which addresses are verified or unverified.

One thing to note: I believe this only works if the email is not already associated with a GH account.

I think if the project included a mailmap file [1], supported by Git, and if Github honored it, this may not be a problem.<p>[1]: <a href="http:&#x2F;&#x2F;git-scm.com&#x2F;docs&#x2F;gitmailmap" rel="nofollow">http:&#x2F;&#x2F;git-scm.com&#x2F;docs&#x2F;gitmailmap</a>

This is trackable, but I had my PR closed and my contributions redressed as another PR a week later by the members of a few different prominent opensource projects, without any communication on their part. And I only realized by chance.

how many email addresses can a person associate with their account? is there the potential for me to develop a bot that scrapes every &quot;unclaimed&quot; email address and claim them? seems like a very poor design choice.

Is it at all relevant that github is not a source of authority for anything, unless the project itself chooses it (and maintainers&#x2F;owners designate it) as the platform of choice for source control?

What happens if multiple github users add the same unverified email address for a particular commit in a repo to their accounts, how does it know which github username to pick to display next to the commit?

so this is obviously an ad for this repography thing, which looks pretty cool.<p>so.. does it do anything interesting with stuff like git blame -CCC which shows the genealogy of copypasta across time within a repo?

Whether working as expected or not, just fix the Linus thing, that is an embarrassment and a surreal one at that.

Sign your commits if you care about this!<p>iirc, isn&#x27;t signing with the same ssh key you push with a possibility?

Why does the email address hijacking only work&#x2F;show up for the first commit?

Because Git&#x2F;Github is source control tool not a forensic tool.

I worked on the security team at GitHub, this was a long standing part of how git works. GitHub allows users to verify commits via GPG signatures to prove that they committed something but it doesn&#x27;t work for proving a negative, that you did not commit something.<p>We got so many of these submissions which are clearly called out in the rules&#x2F;scope, usually the people who don&#x27;t read the rules don&#x27;t find anything useful. ¯\_(ツ)_&#x2F;¯

for these reasons I have started using PGP signing for commits and releases I make

Just ask Sushi Swap.