VCS without committer names?

VCS without committer names?

Postby Lyberta » 22 Jun 2019, 06:15

As part of my boycott of Git because it stores committer names in commits I deleted all my public code and all my Git related accounts. Now I'm looking for version control system that respects their users by not allowing names in commits. Does anyone know such system or do I have to develop one from scratch?
User avatar
Lyberta
 
Posts: 648
Joined: 19 Jun 2013, 10:45

Re: VCS without committer names?

Postby fluffrabbit » 22 Jun 2019, 07:49

I have yet to use Monotone, but due to its totally decentralized nature it probably uses cryptographic signatures at the very least to differentiate users. Though I'm sure there is a name field as well, should one choose to use it.
fluffrabbit
 
Posts: 570
Joined: 11 Apr 2019, 11:17

Re: VCS without committer names?

Postby GunChleoc » 22 Jun 2019, 11:59

Do what I do and use a nickname. Book authors do the same and choose a nome de plume if they don't want to reveal their real name.
User avatar
GunChleoc
 
Posts: 440
Joined: 20 Sep 2012, 22:45

Re: VCS without committer names?

Postby Lyberta » 22 Jun 2019, 17:44

GunChleoc {l Wrote}:Do what I do and use a nickname. Book authors do the same and choose a nome de plume if they don't want to reveal their real name.


But nickname can change too.
User avatar
Lyberta
 
Posts: 648
Joined: 19 Jun 2013, 10:45

Re: VCS without committer names?

Postby GunChleoc » 22 Jun 2019, 18:13

Well, if you post to the internet, it's a publication. If it was a book on paper, you couldn't recall and pulp all the copies either. Also, how would you make the internet archive forget?

How about choosing "anonymous" as a nickname, if you're uncomfortable?
User avatar
GunChleoc
 
Posts: 440
Joined: 20 Sep 2012, 22:45

Re: VCS without committer names?

Postby Lyberta » 23 Jun 2019, 07:11

GunChleoc {l Wrote}:Well, if you post to the internet, it's a publication. If it was a book on paper, you couldn't recall and pulp all the copies either. Also, how would you make the internet archive forget?

How about choosing "anonymous" as a nickname, if you're uncomfortable?


For most other things you change the field somewhere and it is changed. Rewriting git history is much harder. And again, services like GitLab require IANA e-mail address to track your contributions. This is horrible.
User avatar
Lyberta
 
Posts: 648
Joined: 19 Jun 2013, 10:45

Re: VCS without committer names?

Postby GunChleoc » 23 Jun 2019, 11:06

It won't change the field in https://archive.org/web/ though, so the old name will still be visible to everyone anyway.

And don't confuse services like GitLab with git. They use git, but they are not git ;)

Unless somebody finds a version control system that doesn't require information about who committed what, you only have 2 options that I can see:

1. Use "anonymous" as a nickname and a special e-mail address
2. Fork git/mercurial/... and host the repo yourself. Domain privacy instantly becomes an issue here though - you might need to go dark web.
User avatar
GunChleoc
 
Posts: 440
Joined: 20 Sep 2012, 22:45

Re: VCS without committer names?

Postby fluffrabbit » 23 Jun 2019, 13:25

I believe Lyberta already uses Tor, which Git can route through. FGD has its own Git repo, which would be my first choice if I were starting a new FLOSS game. I don't know how well integrated it is with FGD's other services though at this point.

The thing about Git is that as soon as you submit a patch to somebody else's project, the name field doesn't change for those commits unless the project owner changes it, so that's the main drawback here. If on the other hand you're working on your own project, you can automate everything with scripts.

I've got an idea to solve this problem: A federated keystore where all names are stored server-side. If you have the private key, you can verify that you own the public key and ping a keyserver with your new name. Then you put your public key in the VCS name field, and the code host (FGD, GitHub, etc.) retrieves the name corresponding to the key from the keystore for display on the site.
fluffrabbit
 
Posts: 570
Joined: 11 Apr 2019, 11:17

Re: VCS without committer names?

Postby Lyberta » 23 Jun 2019, 15:42

GunChleoc {l Wrote}:It won't change the field in https://archive.org/web/ though, so the old name will still be visible to everyone anyway.


Does it archive Tor hidden services?

GunChleoc {l Wrote}:And don't confuse services like GitLab with git. They use git, but they are not git ;)


Yes but raw git is like raw linux kernel - disgusting and useless.

GunChleoc {l Wrote}:you might need to go dark web.


Of course. To hell with IANA controlled DNS.

fluffrabbit {l Wrote}:I've got an idea to solve this problem: A federated keystore where all names are stored server-side. If you have the private key, you can verify that you own the public key and ping a keyserver with your new name. Then you put your public key in the VCS name field, and the code host (FGD, GitHub, etc.) retrieves the name corresponding to the key from the keystore for display on the site.


Yes, sounds good. Except PGP makes name a part of the key so we need to reinvent something from scratch.
User avatar
Lyberta
 
Posts: 648
Joined: 19 Jun 2013, 10:45

Re: VCS without committer names?

Postby fluffrabbit » 23 Jun 2019, 15:54

Yes, sounds good. Except PGP makes name a part of the key so we need to reinvent something from scratch.

2-key AES with a protocol. The algorithms are the first hard part and fortunately already exist. The infrastructure is the second hard part.

I don't know for sure, but I suspect that PGP is trying to avoid being used as a generic data store, so it makes itself useless for that. Think about it: If you allow up to 200 characters for a name, with base32 encoding one could store 125 bytes of binary data. That's actually not much. Nevermind.
fluffrabbit
 
Posts: 570
Joined: 11 Apr 2019, 11:17

Re: VCS without committer names?

Postby drummyfish » 24 Jun 2019, 20:40

Not knowing too much about this issue, but I think git keeps information about contributors not because they want to track you as a person (that is e.g. for spamming purposes), but because it is pretty important to link contributions to contributors -- e.g. to be able to change a license, you need to contact all contributors, or remove contributions from those who don't agree -- even if those contributors choose to remain anonymous. Having code simply fly into the codebase without any info about the author would be pretty bad for both the project and the contributors (who also wouldn't be able to easily prove they've written it, e.g. in case of license violation), both legally and practically as well ("Does this code come from a regular contributor or a complete newcomer? What can we expect? We can't tell").

So I'd say, and correct me if I'm wrong, that it is perfectly okay for you to use a fake name, and an e-mail that is not your personal e-mail, which just identify you as a single anonymous contributor. You can of course also choose to not use that e-mail at all.

For this reason I also think you shouldn't boycott git for having this feature -- because as I said above, I don't think it is unethical per se -- but rather boycott those who abuse this feature, e.g. require the use of your real name and real e-mail address.
socialist anarcho-pacifist
Abolish all IP laws. Use CC0.
http://www.tastyfish.cz
User avatar
drummyfish
 
Posts: 227
Joined: 29 Jul 2018, 20:30
Location: Moravia

Re: VCS without committer names?

Postby domtron » 24 Jun 2019, 21:06

Just my 2 cents, but I've rewritten all git commit names in a repo before. Had a school project that used my real name and I did a quick search to find out how to do this. So it really isn't that hard. only like 30 minutes of research and 10 minutes to actually do it.

It was a while ago so not sure what I used at the time but a quick search found this: https://help.github.com/en/articles/cha ... uthor-info
domtron
 
Posts: 96
Joined: 10 Jun 2013, 16:22

Re: VCS without committer names?

Postby Lyberta » 25 Jun 2019, 00:11

domtron {l Wrote}:only like 30 minutes of research and 10 minutes to actually do it.


Did you actually read the page you linked to?

To change the name and/or email address recorded in existing commits, you must rewrite the entire history of your Git repository.

Warning: This action is destructive to your repository's history. If you're collaborating on a repository with others, it's considered bad practice to rewrite published history. You should only do this in an emergency.


It says it exactly. If you don't have full control of the repo - you're screwed. And if somebody cloned a repo - they're screwed.

fluffrabbit {l Wrote}:
Yes, sounds good. Except PGP makes name a part of the key so we need to reinvent something from scratch.

2-key AES with a protocol. The algorithms are the first hard part and fortunately already exist. The infrastructure is the second hard part.

I don't know for sure, but I suspect that PGP is trying to avoid being used as a generic data store, so it makes itself useless for that. Think about it: If you allow up to 200 characters for a name, with base32 encoding one could store 125 bytes of binary data. That's actually not much. Nevermind.


Wait, what? I just want a keypair without name attached so I can sign any message or commit and prove that I did it without giving out my name. And maybe GUI app where I can assign names to keys locally.
User avatar
Lyberta
 
Posts: 648
Joined: 19 Jun 2013, 10:45

Re: VCS without committer names?

Postby fluffrabbit » 25 Jun 2019, 00:55

There can be a keypair for PGP-like functionality, but the name in the keypair can be a public AES decryption key that reveals a human-readable name hosted on a federated network, so in effect you get the best of all worlds by having a name you can change from a central decentralized place remotely. As long as servers keep in sync with whatever the current names are, they can display them. As long as they only reveal the names to logged-in users or obfuscate them with some kind of secure AJAX protocol, archive.org can't archive them.

Infographic:

{l Code}: {l Select All Code}
PGP signature ->
  "name" = public AES decryption key ->
    website queries names network ->
      browser makes AJAX request to get name from site
Last edited by fluffrabbit on 25 Jun 2019, 01:04, edited 1 time in total.
fluffrabbit
 
Posts: 570
Joined: 11 Apr 2019, 11:17

Re: VCS without committer names?

Postby Lyberta » 25 Jun 2019, 01:03

fluffrabbit {l Wrote}:There can be a keypair for PGP-like functionality, but the name in the keypair can be a public AES decryption key that reveals a human-readable name hosted on a federated network


Why do we need network at all? Can't I just give my name over XMPP/Tox/whatever personally to someone I trust?

Anyway, I found a solution with git:

{l Code}: {l Select All Code}
git reset $(git commit-tree HEAD^{tree} -m "Commit message")


This will merge all previous commits into one. If you execute this after every commit only your current name will show up. There is no need to rewrite history when there is no history at all.
User avatar
Lyberta
 
Posts: 648
Joined: 19 Jun 2013, 10:45

Re: VCS without committer names?

Postby fluffrabbit » 25 Jun 2019, 01:05

Nobody wants to read a garbled string. Names are convenient for humans. See above infographic.
fluffrabbit
 
Posts: 570
Joined: 11 Apr 2019, 11:17

Re: VCS without committer names?

Postby Lyberta » 25 Jun 2019, 01:13

fluffrabbit {l Wrote}:Nobody wants to read a garbled string. Names are convenient for humans. See above infographic.


Easily solved. I have a bookmark named The Pirate Bay that leads to http://uj3wazyk5u4hnvtk.onion/ I just made it locally.
User avatar
Lyberta
 
Posts: 648
Joined: 19 Jun 2013, 10:45

Re: VCS without committer names?

Postby acme_pjz » 25 Jun 2019, 04:30

Lyberta {l Wrote}:Anyway, I found a solution with git:

{l Code}: {l Select All Code}
git reset $(git commit-tree HEAD^{tree} -m "Commit message")


This will merge all previous commits into one. If you execute this after every commit only your current name will show up. There is no need to rewrite history when there is no history at all.


Then what is the point using git? Why don't you just re-release a source code package (to Freenet, for example) when you made changes to them?
Some of my open source games on GitHub
User avatar
acme_pjz
 
Posts: 654
Joined: 10 Dec 2009, 15:32
Location: PeeKing, China

Re: VCS without committer names?

Postby domtron » 25 Jun 2019, 14:36

Lyberta {l Wrote}:Did you actually read the page you linked to?


I skimmed it, but yes I saw what you said below.

Lyberta {l Wrote}:
To change the name and/or email address recorded in existing commits, you must rewrite the entire history of your Git repository.

Warning: This action is destructive to your repository's history. If you're collaborating on a repository with others, it's considered bad practice to rewrite published history. You should only do this in an emergency.


It says it exactly. If you don't have full control of the repo - you're screwed. And if somebody cloned a repo - they're screwed.


A. it says "considered bad practice" not that it necessarily causes issues though maybe it does, idk. I assume it forces people to basically re-clone the repo which is what you want anyway.
B. If you contributing to a project you never control the repo and therefore cannot make that kind of change anyway.

And B is your point about asking. I was just providing a quick solution if you want to tweak your existing repos you control. Make the name say anonymous, null@null.com or something

Lyberta {l Wrote}:This will merge all previous commits into one. If you execute this after every commit only your current name will show up. There is no need to rewrite history when there is no history at all.


... If your going to do this why even use a VCS? you eliminate the whole purpose of it. Just upload an archive of your code to your website and change it for each version eliminating the extra cruft of a single commit git repo. In fact that can actually keep more history since you would have different version archives.

Anyway I've said more then I really care to about this so will likely ignore the thread from now on.
domtron
 
Posts: 96
Joined: 10 Jun 2013, 16:22

Who is online

Users browsing this forum: No registered users and 1 guest