Hacker News Reader

Comment by bauerd | Hacker News Reader

You'd just end up mistaking commits to my private repositories for work. Also, private contributions have to be enabled in order to show up there.

View on HN

The parent comment speaks to whether many people at the same org are making commits on the weekends. If it is just one person, no biggie, but if it looks like everyone you find is commiting on the weekend then that is a bad signal.

The other edge case would be an environment where every employee is super active in OSS.

Isn’t it a bad idea to use the same account for work as well as personal projects?

Currently I have a separate ‘home’ account for personal projects and I never touch the work ID from my home.

If there are separate accounts then the organisation will likely be private, and you wouldn't be able to research the user accounts in the first place.

That's the whole idea of Github Teams. You just add/remove users to teams and subteams as an organization Owner, and you never get access to anything else on their account or even see their private repos or other organizational memberships.

Except that one is still likely using a company-owned laptop/desktop to access that account. Any data or activity on company hardware (such as private keys or cookies) should be considered visible by them as there’s likely to be remote management software, an IT admin account, encryption key escrow, etc. The legal precedent (in the U.S., anyway) gives an employee no expectation of privacy on a company computer or network.

It would still be a CFAA violation for the employer to use those keys to act as the employee against a third-party serivce like Github. So the employee might not be able to object to them seeing that, but they would have no right to use them to access the employee's account on a remote server. Just like if they found a check on your desk they can look at the numbers, but they can't just use them to take money out.

Also, you could and probably should create a new SSH key on the company laptop or a personal access token for HTTPS access so that it can be easily revoked when you leave.

Reply on news.ycombinator.com