GitHub exposes everyone's email address in GIT commits

https://taylorhakes.com/posts/get-any-github-users-email-address/

by asjfkdlf • 10 years ago

4 12 10 years ago

pwg2• 10 years ago

This is not a github issue. A git commit object contains your email address. This is a basic feature of git.

asjfkdlf3• 10 years ago

Yes, it is a GIT feature/issue. Github does nothing to protect users (by default) from using their personal email in commits. It is definitely not well known though because almost everyone is using their private email address. Go to any big repo and you can see everyone's email.

This is more about education and changing a default.

slang800• 10 years ago

This isn't a bug or a bad default - your email address was never supposed to be private... that's how people contact you (besides the GitHub issues system).

nvivo• 10 years ago

No, it isn't github's fault or git issue. All commit metadata is used to generate (and verify) the commit hash. This is basic git functionality. If you somehow hide this piece of information, you make that repo not only unverifiable but also incompatible with any other clone, including the one in your local machine. You wouldn't be able to push to github.

The only issue here is not realizing the email field in the git config doesn't need to be your personal one or even real. And I agree more people should know this, but this is not something github or git needs to fix in any way.

voltagex_2• 10 years ago

If you have an open source project used by more than yourself, please don't make yourself uncontactable. If you've abandoned the project, make it clear that you have and if you're lucky enough to have an active fork, point to that.

asjfkdlf3• 10 years ago

This isn't about contacting people or communicating the status of a Github project. Github issues are fine way to communicate. If the repo owner isn't responding to issues, I don't think sending email to someone's personal email found through GIT commits is a good option. There is a reason we don't just have everyone's personal email on their Github profile. People don't want spam from people they don't know.

voltagex_2• 10 years ago

It's Git, not GIT.

Anyway, if you tick the keep my address private box on https://github.com/settings/emails, the email field on your profile won't show.

I don't think this is a big issue.

proyb• 10 years ago

It's not an issue, I have been using a separate email for all development purposes. You should always separate your email addresses for different purposes, that including my mobile contacts.

sruffell• 10 years ago

I feel like someone isn't fully groking the beauty of decentralized / distributed version control systems...

hairypotatocat• 10 years ago

wait until he realizes that unsigned commits can be made to look like they're from anyone...

GitHub exposes everyone's email address in GIT commits

Related Stories