[HN Gopher] GitHub Renamed Me (2014)
___________________________________________________________________
GitHub Renamed Me (2014)
Author : SushiHippie
Score : 164 points
Date : 2023-11-22 15:15 UTC (7 hours ago)
(HTM) web link (russbishop.net)
(TXT) w3m dump (russbishop.net)
| pfarrell wrote:
| Without any context or followup, this seems like old news that
| doesn't need to be rehashed on the front page today. This event
| pre-dates the Microsoft purchase of Github.
| afterburner5 wrote:
| Also considering that since the acquisition, they won't do
| anything to dissuade name-squatting anymore, despite their
| terms of service still suggesting otherwise
| ddalcino wrote:
| This is from 2014. Was there ever any resolution to this? I don't
| see any previous discussions about this on HN.
| advisedwang wrote:
| https://github.com/rbishop-xx still points to the author and
| https://github.com/rbishop still points to the Richard B
| mentioned in the post. So if there was a resolution it didn't
| reverse the rename.
| maronato wrote:
| The author created a new GH account
|
| https://github.com/russbishop
| jlnthws wrote:
| I was early adopter and managed to get a 2-letter username but
| I've also been renamed to -xx without notice and any explanation
| :(
| heinekan wrote:
| I've been on the other side of this.
|
| I asked GitHub if they could change my username to one that was
| already taken. As long as the account does not have repos of
| their own and was deemed sufficiently inactive they can take it.
|
| The support staff approved my request, but I have friends who've
| gotten declined.
| ddalcino wrote:
| Sounds like a believable explanation.
|
| > I created my account two years ago in anticipation of being
| able to open-source more code and I wanted to reserve my name;
| I had a couple of forked repos but that's it.
| cortesoft wrote:
| Yeah, sounds like GitHub doesn't let people squat usernames.
|
| The author says GitHub can 'modify his repos at will', but
| earlier he says he doesn't even have any repos besides a few
| forks (which were likely not modified)
| jperras wrote:
| I've actually had a (great) username completely blackholed by
| github. I'm still a bit salty about it.
|
| I had received an email several years ago informing me that it
| was going to be removed. They gave me the equivalent to a
| coupon for a free year of the github personal plan as
| compensation.
|
| To this day it'll tell you that the username is "unavailable"
| if you try to sign up with it, and the page just 404s.
| asylteltine wrote:
| And it's called?
| charcircuit wrote:
| malware is probably the best known case of this
|
| Today the profile just 404s
|
| https://github.com/malware
|
| edit: yep this is his account
| SeenNotHeard wrote:
| And Mike Alware is still salty about it.
| emmelaich wrote:
| More likely Malcolm Ware?
| bigbillheck wrote:
| What was the username?
| jperras wrote:
| As charcircuit figured out, the username is/was `malware`.
| They deactivated it in 2018 without any explanation, and
| even my contacts at Github at the time couldn't quite
| figure out why it was happening.
|
| My only thought was that it was during the MSFT acquisition
| due diligence, and my username was an unfortunate victim of
| whatever compliance requirements they had to satisfy.
| fmeyer wrote:
| That happened to me too, I was able to secure our
| organization's name that way. There was someone squatting on
| it, and it could have caused potential problems if they started
| uploading code. From what I recall about the process, it was
| pretty straightforward - I sent an email and just a few minutes
| later, I had the username linked to me.
| nixgeek wrote:
| Policy on this seems to have shifted in the last 1-2 years.
|
| I've asked personally in the last 12 months for a couple
| situations and been declined by GitHub Support.
|
| Looking quickly on Reddit mine isn't an unusual experience.
|
| It was good while it lasted!
| amacneil wrote:
| Same experience for me. 3 years ago I was able to claim an
| inactive username (the actual process was that you filed a
| complaint about an inactive user, they renamed the account,
| then said "it's available now, good luck you better be
| quick", so it was not an official transfer process).
|
| Tried again about 12 months ago for a different username/org
| and was told this is no longer possible.
| endorphine wrote:
| Same story here
| tripdout wrote:
| Same here, not sure if they still list it but GitHub had a
| name-squatting policy on their site, and after referencing that
| in an email to support, requesting a username of someone who
| only had a handful of repos about 8 years ago, they released
| the username to the public so I could switch to it.
| siva7 wrote:
| The problem was that this process was handled very poorly by
| their support team years ago. No notification or any kind of
| communication with the original owner. What seemed to you
| inactive could have been still an active user. This happened to
| me. It seems that after the Microsoft acquisition things may
| have improved and they don't enforce the name squatting policy
| as easily as before.
| seszett wrote:
| I can't find a followup, but it seems like "rbishop-xx" is still
| there, "rbishop" still owned by someone else, and Russ Bishop has
| moved on to the user "russbishop".
|
| It's still a bit curious and troublesome.
| dobladov wrote:
| This can cause problems in repositories with CODEOWNERS files, at
| the very minimum the change should be notified.
| OJFord wrote:
| If old guy has (or creates without noticing the name change) a
| (possibly private!) repo called 'test', and then new user
| creates one with the same name, when old guy pushes...
|
| I assume they think their checking for emptiness and inactivity
| covers these cases to some reasonable likelihood.
| bastawhiz wrote:
| Nothing will happen when the old guy pushes because the SSH
| key was changed.
| OJFord wrote:
| Well, or was it? Unclear to me why they did that in TFA -
| if they just changed the name, keeping same SSH key on that
| one (now under a new name) would be fine, helpful even. We
| don't know if it was changed/removed on the old name (just
| assume/hope so).
| iamthejuan wrote:
| My user ID in Github is username and they just suddenly name it
| also to usernamex.
| _jal wrote:
| Not github, but I signed up for a service with the username
| 'duplicate_user_id'. It seems someone there didn't find that as
| amusing as I did, locked the account, and refused service.
|
| I can only guess they thought it was setup for some sort of
| scam, but I can't imagine what.
| duped wrote:
| Seems like a reasonable approach to namesquatting, although an
| email notice would probably have been nice.
| ghusto wrote:
| Is it though? For one thing it doesn't stop squatting, since
| all an actual squatter has to do is create a repo with some
| legit looking code. All this does is inconvenience people like
| the author who have legitimate reasons for not having uploaded
| anything yet.
| duped wrote:
| It seems like GH admins are capable of looking at a user and
| making a judgement call (no repos, no activity, no SSH keys,
| and a few forks) to determine that the username is being
| squatted. And based on the article, the author was just name
| squatting. I don't think there's a distinction between
| "legitimate" or not - use it or lose it.
| epcoa wrote:
| Use it or lose it is a good base policy. Just because it
| isn't perfect does not change that. Two years(!) is a long
| time to be sitting idly on a name and is squatting regardless
| of intent or circumstance.
| squeaky-clean wrote:
| Does the author have a legitimate reason for having not
| uploaded anything? I don't see how they're different than any
| other name squatter, they wanted to reserve the name while
| not using it. Another person who goes by rbishop wanted to
| actually use name. From the latter rbishop's perspective,
| Russ was name squatting his username.
|
| Doing a bit of snooping, this post was March 2014, his first
| interaction on Github was February 2015. So he still didn't
| do anything on Github for 11 months after the name change.
| crooked-v wrote:
| > Does the author have a legitimate reason for having not
| uploaded anything?
|
| Plenty of projects are using GitHub as a social hub.
| Pushing code isn't the sole use of a username there.
| pohl wrote:
| But was he using it as a social hub?
| dymk wrote:
| I mean, fair play. If you squat on a username and don't do
| _anything_ with it for years, having it yoinked seems reasonable.
| It 's not like you paid for it.
| benjaminwootton wrote:
| I do actually think this is reasonable. It's really annoying
| when the handle you want is taken by someone who hasn't used it
| for years.
|
| Two years might be a little short though.
| mbauman wrote:
| It feels a little different if -- as it seems to be the case
| -- the GitHub account is used as a static site generator.
| Heck, the guy could've been depending upon CNAMEing to
| `rbishop.github.io`.
| NotYourLawyer wrote:
| Weird not to notify the original owner and give him a chance to
| respond though.
| fallat wrote:
| Yeah I think this is the real issue at hand.
| rand_flip_bit wrote:
| > It's not like you paid for it.
|
| There are individuals that pay ~$4/month for GitHub Teams, plus
| other services (Copilot, CI, LFS, Packages, etc). They may not
| have public repos, but that shouldn't matter.
| paulddraper wrote:
| You are talking about something different.
| Ferret7446 wrote:
| I doubt GitHub is going to close the account of an actively
| paying user. Rather, the fact that they are paying for it
| constitutes proof that the account is actively owned.
| notorandit wrote:
| There is no cloud, dude. It is someone else's computer. Deeply
| buried somewhere it is written they can do anything with your
| stuff that resides on their computers.
|
| Or simply they can do it, then it'll up to you to sue them.
|
| Good luck!
| OJFord wrote:
| I wonder if they've ever used, or wanted to use, a path or org
| themselves (like actions, say) that was taken by some external
| user.
|
| Seems a good idea to put user generated content somewhere else,
| like example.com/users/OJFord instead of top-level say, and then
| if you decouple handle from displayed name people don't care to
| claim they're clean name as in OP so much either. But of course
| for the URL, you have to think of that in your early days -
| GitHub can't break all those links now!
| not_your_vase wrote:
| If you want your own username, don't use someone else computer.
| Self-host github/gitlab/gitea/whatev, and use your favorite
| username, without the fear of losing it.
| tgsovlerkhgsel wrote:
| Wow. This has pretty terrifying implications if people are using
| GitHub to sign into other services.
| forgotpwd16 wrote:
| Username and user ID are distinct. If username was the ID, you
| couldn't even change it yourself.
| sandaru1 wrote:
| How would this affect you if you are using Github as a OAuth
| provider? Does Github mention under what conditions they are
| going to take away someone's username? No code? No OAuth? No
| activity?
| bastardoperator wrote:
| Most corps are looking at GH EMU, which means you bring the
| username/email address, and that a public GH username is not
| possible. This also prevents the creation of public
| repositories.
|
| https://docs.github.com/en/enterprise-cloud@latest/admin/ide...
|
| The people they care about don't use GitHub oauth, but instead
| use their own private idp like Okta.
| grumple wrote:
| That is troubling. Does this mean Github staff can basically take
| over any private account without contacting the owners? Can
| regular staff access private repos? Could they quietly manipulate
| my own repos by changing my ssh key and pushing commits? Sky's
| the limit in terms of the negative impact that could have. Does
| SSO with Github depend on the username? Would a renamed account
| be able to access services where I used "Sign in with Github"?
| blep_ wrote:
| (I don't work at Github, these are inferences from working on
| other cloud services)
|
| > Does this mean Github staff can basically take over any
| private account without contacting the owners?
|
| That's an incredibly common feature to have on the admin side.
| Three of the four companies I've worked at have had some form
| of "log in as this user" button, with general guidance to not
| do anything dumb. The fourth had good reasons for not
| supporting that, but it made debugging anything happening in
| production incredibly annoying.
|
| > Could they quietly manipulate my own repos by changing my ssh
| key and pushing commits?
|
| They _literally own the servers_. They don't need your ssh key.
| Likely not _everyone_ has direct filesystem access, but at
| least a few people do.
|
| By hosting anything on a cloud service, you are trusting the
| people running that service. If you don't trust them, don't do
| that.
| dkarras wrote:
| this happened to me as well. I had repos, I was even approved
| members of several large scale open source projects. Just did not
| have to do anything related to GitHub for a few years. Turns out
| they renamed me and gave my name to someone else upon request. My
| links to various repos in my github scattered around the internet
| (with the old username) still works (so I assume, the new owner
| can't create repos with the same names). Don't know why GitHub
| goes through all those hoops to allow this to be honest (yes I'm
| salty). Like if it was just a registration and empty account that
| is understandable but they renamed an account full of repos and
| memberships and their infrastructure supports keeping old links
| active etc. Just weird.
| siva7 wrote:
| Happened to me also. I had registered my username in the first
| year Github started. Around 10 years later i discovered that
| someone else assumed my username through reaching out to their
| support. I was using Github still actively but hadn't committed
| for quite some time in public. I was very pissed when i
| discovered. Support refused to change my name back instead giving
| me a coupon i never asked for. Whoever thought at Github this to
| be a good idea didn't think through. It's like the most retarded
| solution to a problem every social platform faces i've seen so
| far in how it is checked through.
| ZWoz wrote:
| I found amusing that IP address in one screenshot has following
| field in whois:
|
| Address: 1800 Bishops Gate Blvd
|
| Isn't gate common way to suffix scandals in USA?
| throwboatyface wrote:
| Bishops Gate has been a place before Watergate happened.
| ZWoz wrote:
| Sure, Gate is somewhat common way to naming places. Not
| really related to trouble in article, but nice coincidence,
| we have Bishops and Gate.
| king_geedorah wrote:
| Lots of discussion on the name changing portion of this, but I'm
| more perplexed by the github dev / support adding an SSH key to
| the account. Obviously they have that kind of access to the data
| / accounts hosted in their infra, but I don't really understand
| why that would have been necessary or why they didn't remove the
| key afterwards.
| pbhjpbhj wrote:
| So you make usernamex, username-x, username-xx accounts and
| populate the repos ... do they then bump you to username-y?
___________________________________________________________________
(page generated 2023-11-22 23:02 UTC)