That's mostly correct. We use the email addresses provided in the commit Author and Committer fields and correlate them with the email addresses associated with GitHub user accounts. The commit Author/Committer email addresses are also used to fetch gravatar images even when no GitHub user account exists for the email.

It's trivial to spoof these fields using the --author argument to git-commit(1), by setting the GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL environment variables, or by setting a different name/email using git-config(1).

Thanks. So it didn't cross my mind that this was some huge security flaw, I would have reported something like that privately. I hope starting this discussion does not cause any unecessary confusion.

GitHub rocks, it has really changed our contributor attitudes. I am a happy, paying customer (another account) and just really hope you guys are around a long time!

> GitHub rocks, it has really changed the contributor attitudes for my main project, I am a paying customer (another account)

Thanks!

> and just really hope you guys are around a long time!

We'll be here. It's a profitable business with a straightforward model and we intend to keep it that way.

Would you care to elaborate a little? I only understand it partially.

So, you aren't 'dhh' but you commited using his email address and it showed up as him?

It's on a par with using a forged From header over SMTP. You can send e-mail as pretty much anyone. (Though technologies like SPF are helping clamp down on this.)

"Joe jobbing" is when spammers use real e-mail addresses in their From headers so that that person gets the flak. In a round about way, this is the same for patches/commits :-)

He changed his git config so that user.email was [email protected] (The email DHH lists on GitHub). GitHub then automatically says "oh, this is by [email protected], so let's put his avatar there and link to his profile as the author."

Changing the config is as simple as

    git config user.email "[email protected]"

And you can add a --global flag if you want that to be the default for all repos instead of just the one you're on.

Edit: There's also some way to do it with a --author= flag when you commit.

You have it correct. What you say in your second sentence is exactly the issue.

If this is "actually" a big issue or not is another question.

Sure, all it does is links the commit to a github login. It doesn't somehow give you access to any data that's not yours. You've just discovered another way to post spam.

I would hope people didn't blindly accept patches off of merit anyways, or is there another problem I am missing?

Edit: not to say this shouldn't be fixed I am curious if this implies anything else that I may be missing.

No patch has been accepted (unless I mis-understood what you are saying).

In fact, if it's not totally obvious to everyone that timf is the one that committed the latest commit, then this demonstration is noteworthy.

I was simply stating that patches shouldn't be accepted just because a high profile person submitted it (which this could possible be used to spoof for malicious intent).

As for the second part I was wondering if this had any other implications such as committing to someone else repo or if it is just masking identities with another users.