GitHub's email correlation for authorship

Re:GitHub's email correlation for authorship by rtomayko on Wednesday May 12, 2010 @06:59PM (#1342562)

That's mostly correct. We use the email addresses provided in the commit Author and Committer fields and correlate them with the email addresses associated with GitHub user accounts. The commit Author/Committer email addresses are also used to fetch gravatar images even when no GitHub user account exists for the email.

It's trivial to spoof these fields using the --author argument to git-commit(1), by setting the GIT_AUTHOR_EMAIL/GIT_COMMITTER_EMAIL environment variables, or by setting a different name/email using git-config(1).

[ Parent | on HN ]

Re:GitHub's email correlation for authorship by timf on Wednesday May 12, 2010 @07:07PM (#1342590)

Thanks. So it didn't cross my mind that this was some huge security flaw, I would have reported something like that privately. I hope starting this discussion does not cause any unecessary confusion.

GitHub rocks, it has really changed our contributor attitudes. I am a happy, paying customer (another account) and just really hope you guys are around a long time!

[ Parent | on HN ]

Re:GitHub's email correlation for authorship by rtomayko on Wednesday May 12, 2010 @07:20PM (#1342615)

> GitHub rocks, it has really changed the contributor attitudes for my main project, I am a paying customer (another account)

Thanks!

> and just really hope you guys are around a long time!

We'll be here. It's a profitable business with a straightforward model and we intend to keep it that way.

[ Parent | on HN ]