GitHub Renamed Me (2014)

by SushiHippie • 3 years ago

216 73 3 years ago

pfarrell• 3 years ago

Without any context or followup, this seems like old news that doesn't need to be rehashed on the front page today. This event pre-dates the Microsoft purchase of Github.

afterburner5• 3 years ago

Also considering that since the acquisition, they won't do anything to dissuade name-squatting anymore, despite their terms of service still suggesting otherwise

ddalcino2• 3 years ago

This is from 2014. Was there ever any resolution to this? I don’t see any previous discussions about this on HN.

advisedwang• 3 years ago

https://github.com/rbishop-xx still points to the author and https://github.com/rbishop still points to the Richard B mentioned in the post. So if there was a resolution it didn't reverse the rename.

maronato• 3 years ago

The author created a new GH account

https://github.com/russbishop

jlnthws• 3 years ago

I was early adopter and managed to get a 2-letter username but I’ve also been renamed to -xx without notice and any explanation :(

heinekan• 3 years ago

I’ve been on the other side of this.

I asked GitHub if they could change my username to one that was already taken. As long as the account does not have repos of their own and was deemed sufficiently inactive they can take it.

The support staff approved my request, but I have friends who’ve gotten declined.

ddalcino2• 3 years ago

Sounds like a believable explanation.

I created my account two years ago in anticipation of being able to open-source more code and I wanted to reserve my name; I had a couple of forked repos but that's it.

cortesoft• 3 years ago

Yeah, sounds like GitHub doesn't let people squat usernames.

The author says GitHub can 'modify his repos at will', but earlier he says he doesn't even have any repos besides a few forks (which were likely not modified)

jperras2• 3 years ago

I've actually had a (great) username completely blackholed by github. I'm still a bit salty about it.

I had received an email several years ago informing me that it was going to be removed. They gave me the equivalent to a coupon for a free year of the github personal plan as compensation.

To this day it'll tell you that the username is "unavailable" if you try to sign up with it, and the page just 404s.

asylteltine• 3 years ago

And it’s called?

bigbillheck• 3 years ago

What was the username?

fmeyer• 3 years ago

That happened to me too, I was able to secure our organization's name that way. There was someone squatting on it, and it could have caused potential problems if they started uploading code. From what I recall about the process, it was pretty straightforward - I sent an email and just a few minutes later, I had the username linked to me.

nixgeek• 3 years ago

Policy on this seems to have shifted in the last 1-2 years.

I’ve asked personally in the last 12 months for a couple situations and been declined by GitHub Support.

Looking quickly on Reddit mine isn’t an unusual experience.

It was good while it lasted!

amacneil• 3 years ago

Same experience for me. 3 years ago I was able to claim an inactive username (the actual process was that you filed a complaint about an inactive user, they renamed the account, then said "it's available now, good luck you better be quick", so it was not an official transfer process).

Tried again about 12 months ago for a different username/org and was told this is no longer possible.

endorphine• 3 years ago

Same story here

tripdout• 3 years ago

Same here, not sure if they still list it but GitHub had a name-squatting policy on their site, and after referencing that in an email to support, requesting a username of someone who only had a handful of repos about 8 years ago, they released the username to the public so I could switch to it.

siva72• 3 years ago

The problem was that this process was handled very poorly by their support team years ago. No notification or any kind of communication with the original owner. What seemed to you inactive could have been still an active user. This happened to me. It seems that after the Microsoft acquisition things may have improved and they don’t enforce the name squatting policy as easily as before.

preciousoo• 3 years ago

I did this (request an inactive name) for a username many years ago, which led to people scraping my personal email from commits, and using information I used in my readme to contact me and ask for it. “It’s my real name” and other stories.

I almost gave it away the first time, but the person wouldn’t provide proof of it being their name. Future requests made me realize it was just a coveted username

cedws• 3 years ago

Any idea if they still grant requests like this? There are some pretty nice usernames taken by completely empty accounts.

seszett• 3 years ago

I can't find a followup, but it seems like "rbishop-xx" is still there, "rbishop" still owned by someone else, and Russ Bishop has moved on to the user "russbishop".

It's still a bit curious and troublesome.

dobladov• 3 years ago

This can cause problems in repositories with CODEOWNERS files, at the very minimum the change should be notified.

OJFord4• 3 years ago

If old guy has (or creates without noticing the name change) a (possibly private!) repo called 'test', and then new user creates one with the same name, when old guy pushes...

I assume they think their checking for emptiness and inactivity covers these cases to some reasonable likelihood.

bastawhiz2• 3 years ago

Nothing will happen when the old guy pushes because the SSH key was changed.

iamthejuan• 3 years ago

My user ID in Github is username and they just suddenly name it also to usernamex.

_jal• 3 years ago

Not github, but I signed up for a service with the username 'duplicate_user_id'. It seems someone there didn't find that as amusing as I did, locked the account, and refused service.

I can only guess they thought it was setup for some sort of scam, but I can't imagine what.

duped2• 3 years ago

Seems like a reasonable approach to namesquatting, although an email notice would probably have been nice.

ghusto2• 3 years ago

Is it though? For one thing it doesn't stop squatting, since all an actual squatter has to do is create a repo with some legit looking code. All this does is inconvenience people like the author who have legitimate reasons for not having uploaded anything yet.

duped2• 3 years ago

It seems like GH admins are capable of looking at a user and making a judgement call (no repos, no activity, no SSH keys, and a few forks) to determine that the username is being squatted. And based on the article, the author was just name squatting. I don't think there's a distinction between "legitimate" or not - use it or lose it.

epcoa• 3 years ago

Use it or lose it is a good base policy. Just because it isn’t perfect does not change that. Two years(!) is a long time to be sitting idly on a name and is squatting regardless of intent or circumstance.

squeaky-clean• 3 years ago

Does the author have a legitimate reason for having not uploaded anything? I don't see how they're different than any other name squatter, they wanted to reserve the name while not using it. Another person who goes by rbishop wanted to actually use name. From the latter rbishop's perspective, Russ was name squatting his username.

Doing a bit of snooping, this post was March 2014, his first interaction on Github was February 2015. So he still didn't do anything on Github for 11 months after the name change.

dymk2• 3 years ago

I mean, fair play. If you squat on a username and don't do anything with it for years, having it yoinked seems reasonable. It's not like you paid for it.

benjaminwootton• 3 years ago

I do actually think this is reasonable. It's really annoying when the handle you want is taken by someone who hasn't used it for years.

Two years might be a little short though.

mbauman• 3 years ago

It feels a little different if — as it seems to be the case — the GitHub account is used as a static site generator. Heck, the guy could've been depending upon CNAMEing to `rbishop.github.io`.

NotYourLawyer• 3 years ago

Weird not to notify the original owner and give him a chance to respond though.

fallat• 3 years ago

Yeah I think this is the real issue at hand.

rand_flip_bit• 3 years ago

It's not like you paid for it.

There are individuals that pay ~$4/month for GitHub Teams, plus other services (Copilot, CI, LFS, Packages, etc). They may not have public repos, but that shouldn't matter.

paulddraper• 3 years ago

You are talking about something different.

Ferret7446• 3 years ago

I doubt GitHub is going to close the account of an actively paying user. Rather, the fact that they are paying for it constitutes proof that the account is actively owned.

funcDropShadow• 3 years ago

Why did the Github support add an ssh key, though?

dymk2• 3 years ago

Added to the account after it was transferred to its new owner.

notorandit• 3 years ago

There is no cloud, dude. It is someone else's computer. Deeply buried somewhere it is written they can do anything with your stuff that resides on their computers.

Or simply they can do it, then it'll up to you to sue them.

Good luck!

OJFord4• 3 years ago

I wonder if they've ever used, or wanted to use, a path or org themselves (like actions, say) that was taken by some external user.

Seems a good idea to put user generated content somewhere else, like example.com/users/OJFord instead of top-level say, and then if you decouple handle from displayed name people don't care to claim they're clean name as in OP so much either. But of course for the URL, you have to think of that in your early days - GitHub can't break all those links now!

not_your_vase• 3 years ago

If you want your own username, don't use someone else computer. Self-host github/gitlab/gitea/whatev, and use your favorite username, without the fear of losing it.

tgsovlerkhgsel2• 3 years ago

Wow. This has pretty terrifying implications if people are using GitHub to sign into other services.

forgotpwd16• 3 years ago

Username and user ID are distinct. If username was the ID, you couldn't even change it yourself.

tgsovlerkhgsel2• 3 years ago

That assumes that all third party sites use the user ID, not the username. From my understanding, the way "login with Github" works is by the app getting an OAuth token, then querying a "give me the currently logged in user" API using that token, which then returns an object identical to https://api.github.com/users/rbishop

If the client keys on "login" rather than "id" (this GitHub tutorial, for example, only mentions the former, not the latter: https://docs.github.com/en/apps/creating-github-apps/writing...) and then stores "github user rbishop can access account 123456 on our system", the new owner of the account name would likely be able to hijack the previous owner's 3rd party accounts.

sandaru1• 3 years ago

How would this affect you if you are using Github as a OAuth provider? Does Github mention under what conditions they are going to take away someone's username? No code? No OAuth? No activity?

bastardoperator• 3 years ago

Most corps are looking at GH EMU, which means you bring the username/email address, and that a public GH username is not possible. This also prevents the creation of public repositories.

https://docs.github.com/en/enterprise-cloud@latest/admin/ide...

The people they care about don't use GitHub oauth, but instead use their own private idp like Okta.

grumple• 3 years ago

That is troubling. Does this mean Github staff can basically take over any private account without contacting the owners? Can regular staff access private repos? Could they quietly manipulate my own repos by changing my ssh key and pushing commits? Sky's the limit in terms of the negative impact that could have. Does SSO with Github depend on the username? Would a renamed account be able to access services where I used "Sign in with Github"?

blep_• 3 years ago

(I don't work at Github, these are inferences from working on other cloud services)

Does this mean Github staff can basically take over any private account without contacting the owners?

That's an incredibly common feature to have on the admin side. Three of the four companies I've worked at have had some form of "log in as this user" button, with general guidance to not do anything dumb. The fourth had good reasons for not supporting that, but it made debugging anything happening in production incredibly annoying.

Could they quietly manipulate my own repos by changing my ssh key and pushing commits?

They _literally own the servers_. They don't need your ssh key. Likely not _everyone_ has direct filesystem access, but at least a few people do.

By hosting anything on a cloud service, you are trusting the people running that service. If you don't trust them, don't do that.

dkarras• 3 years ago

this happened to me as well. I had repos, I was even approved members of several large scale open source projects. Just did not have to do anything related to GitHub for a few years. Turns out they renamed me and gave my name to someone else upon request. My links to various repos in my github scattered around the internet (with the old username) still works (so I assume, the new owner can't create repos with the same names). Don't know why GitHub goes through all those hoops to allow this to be honest (yes I'm salty). Like if it was just a registration and empty account that is understandable but they renamed an account full of repos and memberships and their infrastructure supports keeping old links active etc. Just weird.

siva72• 3 years ago

Happened to me also. I had registered my username in the first year Github started. Around 10 years later i discovered that someone else assumed my username through reaching out to their support. I was using Github still actively but hadn’t committed for quite some time in public. I was very pissed when i discovered. Support refused to change my name back instead giving me a coupon i never asked for. Whoever thought at Github this to be a good idea didn’t think through. It’s like the most retarded solution to a problem every social platform faces i’ve seen so far in how it is checked through.

ZWoz2• 3 years ago

I found amusing that IP address in one screenshot has following field in whois:

Address: 1800 Bishops Gate Blvd

Isn't gate common way to suffix scandals in USA?

throwboatyface• 3 years ago

Bishops Gate has been a place before Watergate happened.

ZWoz2• 3 years ago

Sure, Gate is somewhat common way to naming places. Not really related to trouble in article, but nice coincidence, we have Bishops and Gate.

king_geedorah• 3 years ago

Lots of discussion on the name changing portion of this, but I’m more perplexed by the github dev / support adding an SSH key to the account. Obviously they have that kind of access to the data / accounts hosted in their infra, but I don’t really understand why that would have been necessary or why they didn’t remove the key afterwards.

pbhjpbhj• 3 years ago

So you make usernamex, username-x, username-xx accounts and populate the repos ... do they then bump you to username-y?

deceptionatd• 3 years ago

This seems... deeply idiotic on GitHub's part. Consider the following scenario:

1. A script/CI/etc is pulling the latest releases from the repository. 2. Ownership of the account is changed. 3. The new owner controls the contents of the repository, and can perform a supply chain attack.

I'm not sure GitHub would be liable there, but personally I wouldn't want to find out the hard way.

GitHub Renamed Me (2014)

Related Stories