Slashdot Mirror
Should GitHub Allow Username Reuse? (donatstudios.com)
Jesse Donat argues via Donut Studios why GitHub should never allow usernames to be valid again once they are deleted. He provides an example of a user who deleted his GitHub account and personal domain with a popular tool used for embedding data files into Go binaries. "While this is within his rights to do, this broke a dependency many people had within their projects," Donat writes. "To fix this, some users of the project recreated the account and the repository based on a fork of the project." Donat goes on to write: Allowing username reuse completely breaks any trust that what I pull is what it claims to be. What if this user had been malicious? It may have taken a while before someone actually noticed this wasn't the original user and the code was doing something more than it claimed to.
While Go's "go get" functionality is no doubt naive and just pulls the head of a repository, this is not exclusively Go's problem as this affects any package manager that runs on tags. Simply tag malicious changes beyond the current release and it would be deployed to many users likely with little actual review.
While Go's "go get" functionality is no doubt naive and just pulls the head of a repository, this is not exclusively Go's problem as this affects any package manager that runs on tags. Simply tag malicious changes beyond the current release and it would be deployed to many users likely with little actual review.
because it's not a problem with github; it's a problem with morons misusing github.
Copyright (c) 1990 - 2014 Dice. All rights reserved. Use of this comment is subject to certain Terms and Conditions.
No. No. No.
A URL is not tied to an identity. The only way to verify who wrote the code is to use digital signatures.
{{.sig}}
The package manager and dependency programmer should check either the hash or another cryptographic property of the code to authenticate the code.
This is the same as someone re-registering an expired domain or simply poisoning the repository or even hacking the dns in your router. Unless you can check you have an authentic package, signed by a known author, you're purely depending on the goodwill of the Internet.
I would think this is kind of mandatory but I guess Go/JavaScript developers don't need to think about security, the language/platform is secure.
Custom electronics and digital signage for your business: www.evcircuits.com
Spelled my last name wrong the second time but not the first ;)
I'm not sure why there isn't a PKI system for this like with ssh or other open source projects. Once you've established the trust it would then warn you if it was signed with a different key. It's shocking that this most basic warning system doesn't exist.
"[We'll be] really getting inside your head and making it an unpleasant place to be" -- Trent Reznor
This doesn't solve anything. Just like various browser extensions for Chrome or whole Android Apps are sold and then made into adware or worse. There the whole account is basically bought, and the same can be done in github. If people continue to misuse github as a package repository, it will happen sooner or later.
Well, maybe they should do something like give everyone the equivalent of a date of birth at the end of the username, so that people can be distinguished even if they have the same core name.
Otherwise, as time goes on, won't we start to run out of names if you can never reuse them?
How do we deal with this problem for actual human beings who have similar names?
A username should serve only as a human-readable identifier, it should not serve as an identifier that is used by itself for any security purposes at all. If a person changes their username, their previous name should be available for reuse, just as a disconnected phone number is, but in the case of usernames, you could still readily tell the previous user from the current one because the unique identifier could be checked.
If a person doesn't think to check the unique ID, then that's their own bloody fault... about on par with a person not checking that a cashier has handed them back the right amount of change and not noticing any discrepancy until they got home.
File under 'M' for 'Manic ranting'
Then you're a dangerous amateur and you should immediately stop developing software for the good of all humanity.
Establishing the trust is another big issue, especially when bringing up a particular environment for the first time on a given machine. How many people make a point of verifying the server key fingerprint the first time they connect to a particular SSH server?
If this is a common problem for you, then you are choosing the wrong projects to depend on.
"First they came for the slanderers and i said nothing."
Go has a pretty stupid package manager if it's relying on a URL to deliver binaries to clients. Any code (binary or source) should be signed and signatures cross-checked in a distributed registry. If you think github name resuse is going to stop this you need to switch languages.
I think a source repository should be allowed to be deleted, and a username to not be reused. I think it's a huge mistake -- and I never have -- to use a repo as a dependency. Grab sources from a repo and if the head goes away stay with what you have. I have nuget packages that can't and should never be deleted.
They treat it as a foregone conclusion that this person should have this right. But if him deleting his account and all associated code off github can impact other projects, I fail to see why he should have that right.
Github is a repo. Of course you should be able to delete projects, otherwise it would contain even more dead projects than it already does. You publish code and share it with the world. People download it and use it. You abandon it and delete the project. The problem is not you deleting it but the person depending on it to stay there. If I share something with you with an open source license then you are free to download a copy but if I decide to unpublisg then it's up to new users to snag it from someone who managed to download it before it disappeared.
How's life in the hypocrite lane?
That's why we have SSH and PGP keys on GitHub.
Kriston
You sign a tag so that it's verifiable that no one else could have possibly created the tag, so if a malicious user gets your account name but not your private key, they can't create new tags.
User accounts are not something unique to GitHub, and I would expect any service that lets you pick usernames to allow reuse, otherwise eventually you are left with random letters and numbers as users move on.
12 best practices for user account, authorization and password management
https://cloudplatform.googlebl...
In that case, not even by the same person for more than one transaction. This is pointless.
Yeah, most open source licenses allow others to fork the code and/or redistribute it, clearly indicated as such, since the creator still owns and legally controls the original code. Github telling a creator they can't delete their own repository would go far beyond that
"You have deleted your repository. But prior to that, we have exercised our right under the GNU General Public License to fork your repository and make it available to the public through the same URL."