Hacker News Reader

Comment by traverseda | Hacker News Reader

Of course now every pull is authenticated and they can track exactly what users are pulling from what public repositories. Before it used to be that I only really authenticated when I did a git push.

So now when using plain git the choices are to have every action tracked, or to go through a very annoying process involving randomly generated keys.

Not that they couldn't guess that information based on IP address (presuming you're not behind a university NAT or something), but removing password auth does seem like a pretty clear attempt at gathering more user data.

View on HN

Nonsense.

You have been able to clone over https since day 1 of Github and still can:

    git clone https://github.com/user/repository

> So now when using plain git the choices are to have every action tracked, or to go through a very annoying process involving randomly generated keys.

EDIT: this alias has a bug that means it doesn't work as intended, see below, don't use it

If you're that worried, I threw this shitty Bash function together in five minutes just now; stick this in your bashrc and then `anongit ...` instead of `git`:

  anongit () {
    mkdir -p ~/.random-ssh-keys
    KEYNAME=$(openssl rand -hex 12)
    KEYFILE=~/.random-ssh-keys/$KEYNAME
    ssh-keygen -q -C $KEYNAME -N "" -f $KEYFILE
    GIT_SSH_COMMAND="ssh -i $KEYFILE" git "$@"
  }

Problem solved!

...or you could clone over HTTPS instead :)

GitHub doesn't just need any SSH key, it needs an SSH key attached to an account, probably for abuse/DoS prevention purposes.

Shit, you're probably right. It only worked because I didn't tell SSH to only use the specified identity files (I threw it together in five minutes without really testing it, you can forgive me). Changing one of the lines to this (which it should have been all along):

    GIT_SSH_COMMAND="ssh -i $KEYFILE -o IdentitiesOnly=yes" git "$@"

...comes up with "Permission denied (publickey)". So, yep, you're 100% right.

Oh well. There's still HTTPS!

Reply on news.ycombinator.com