Hacker News Reader

Comment by MattGaiser | Hacker News Reader

I'm really surprised at the number of personal GitHub accounts that are being used in my org and at others. I guarantee their access isn't being removed when they depart.

And it seems common at a ton of companies.

View on HN

GitHub actually manages attaching business org to personal accounts very well.

You can make notification emails related to the business org repos go to your work email, while all other notification emails go to your personal email.

When you fork a business org private repo into your account, it stays attached to the business org. Other members of the org can push to your fork of that repo but not your other personal or open-source repos. When your account is separated from the org, you lose access to your fork.

If the business org requires extra SAML/OIDC through their central auth service, you can still access your personal and public repos without doing it.

So yeah the business still has to remember to disconnect you from the org when you leave the company, but that's still true if you make a new github account anyway?

Because GitHub makes it hard (i.e. impossible) to manage multiple accounts.

No account switching on the website, no easy way to use multiple SSH keys to access multiple accounts when using Git.

Shouldn't you mostly be using them on separate computers though? The rare times I need my personal one at work (to view how I solved something before), I just open Incognito.

Obligatory plug for Firefox Containers

Or, you know, having multiple profiles in Chrome (which have existed much longer).

Or, you know, multiple profiles in Firefox which has existed even longer. I use both.

I'm self-employed and always on-call. Not suggesting this is the right way for anyone else, but trying to unravel a combined life to even multiple accounts on a single computer sounds like a nightmare.

This is one of those times where Qubes OS makes these things so much easier. It allows you to easily split everything between the different roles.

You can set up a new host in your ssh config and specify a key different from your main account and it should swap your accounts based on the key. Additionally, you can set a git config to be included if you’re in a particular directory so that you can change your commit details.

I’m on a mobile device so excuse the vagueness, but if there’s interest I can provide some resources and go more in depth.

A new host with what hostname? Because git uses github.com for all repos.

put this in your ~/.ssh/config

    Host personal.github.com
          HostName github.com
          User git
          IdentityFile ~/.ssh/id_rsa_personal

then clone from git@personal.github.com/x.git for personal stuff

The host also doesn’t have to be a “real” host. You could do something like github-personal for example.

Thanks for the assist fnord77!

Newbie here. Where should I type `github-personal` ?

In the example, fnord77 posted, you can replace all the places that they used personal.github.com. It will be usable anywhere you would use ssh, including when going through a few tools that ultimately resolve to an ssh invocation. I won't copy the host block in .ssh/config but you could, for example:

`sshuttle -r my-cloud-server 0/0` for a poor man's vpn

`ssh some-enterprise-server` for when the server has a user unfriendly domain name that you don't want to bother remembering

`git clone git@github-personal:myusername/somerepo.git` when you want to clone using your personal key from GitHub.

There is the caveat, though, that you may have some nested dependencies that will use the plain ole every day host name in which case things will break for you. It rarely comes up, though, in my experience.

Just posted a more complete example above

https://news.ycombinator.com/item?id=28242339

Wow! I don’t know why I hadn’t thought of that, even though I use aliases all the time for SSH. Seems my brain got stuck on the domain part. ^_^

How do you deal with submodules?

This is a limitation that I haven't really found a way through. I haven't tried too hard though because I've found that I can often just let the complicating set up have the 'plain' github.com host and use the custom host for the other set up. If I found that both professionally and personally I needed submodules, though, I'd probably be in trouble.

Also, if the submodules are public, the plain host will work fine because it doesn't matter what key you authenticate with.

So one thing you can do is put the following in your ~/.gitconfig:

  [includeIf "gitdir:/home/john/corp/**"]
      path = .gitconfig-corp

And then ~/.gitconfig-corp:

  [user]
    email = john@example.com
    name = John Doe


  [url "git@github.com-corp"]
    insteadOf = git@github.com

Now all repos under the path /home/john/corp/ will use that config. Then you can put a new host in your SSH config:

  Host github.com-corp
    HostName github.com
    User git
    IdentityFile /home/john/.ssh/corp_github

This way you can have different e-mail address and name in your commit messages as well.

Due to the nature of git you can't scope it via GH URL (you can have many remotes in the same local repo). Though you can still manually rewrite when you add a remote with just the SSH config change, e.g.

  git clone git@github.com-corp:corp/foobar.git

Thank you. The `host` field always has to have the format `word.word`? Or it can be just `word` without any dot in the middle?

You can call it anything you want save of whitespace (albeit I personally haven't tried emoji or other non-ASCII shenanigans :))

Thank you. Why is it that all examples in this thread use `.com` somewhere in the middle of the string used for the `host` field?

Personally I just found it natural to tack on a suffix. But you do you :)

Why is it natural? Do hosts usually have a suffix? Why?

I guess if you have a more complex matrix of personas and remote servers (not only GH), structure and predictability becomes more important than terseness.

But again, it's just personal preference.

Why should they? All that stuff is easily managed locally under your own control.

What the hell? Everything you claim is false.

Reply on news.ycombinator.com