GitHub education pack requesting real name on public profile | Hacker News Reader

GitHub education pack requesting real name on public profile

github.com

99 pointsfernvenue59 comments

Github education is broken. They have automated it and it doesn’t work in edge cases. There is no manual intervention. I got denied because - my university is in city A and I study online in city B. It detects my location automatically and denies because I am not in my university campus. Wtf. - they have an alternate to upload some documents to prove otherwise. Whatever documents my non-US university has is declined by their ML. Also you cannot upload pdf docs. Need to take a picture of pdf to upload.

"Real name policies" might be or eventually become illegal in some jurisdictions.

https://computersciencewiki.org/index.php/Right_to_anonymity

https://www.theverge.com/2018/2/12/17005746/facebook-real-na...

https://www.oaic.gov.au/privacy/australian-privacy-principle...

Isn’t “John Smith” a real name? There’s even people who use it on a daily basis

there was a time that it was considered "the most common name in England".

So, yeah, I assume there are many people using it on a daily basis, more than anyone else at one point in history for a particular geographic distribution.

However, this may actually have been a myth, since I can't seem to find any data to back up this claim.

Can write literally any name, if they complain it doesn't match the ID they have on file, say that's your deadname. Simple as that. GitHub as an organisation is very politically correct and I doubt they'd contest it.

what's the point of github education now that they have unlimited private repos for everyone?

The GitHub Student Developer Pack: https://education.github.com/pack/offers

This page is not available when not logged in and after logging in does not really disclose IMHO what the Student Developer Pack offers.

This link should be visible: https://education.github.com/pack

Short answer:

- Free GitHub Pro

- A few hundred bucks of free credits on DigitalOcean, Azure, Heroku

- A few different free domain registration offers

- A few coding courses

- Some other software and SaaS at no cost

You can get Copilot for free if that's your thing.

Yep, few of my classmates had a problem with it. Just change your name temporarily and then change it back :/ ... sucks but works atm

I did this unintentionally.. so this is the reason it worked.

More complicated than getting the NFL Sunday Ticket. Why can’t they just verify an edu email like the rest of the world? Afraid of people abusing it?

As far as I can tell, the entire rest of the world is also moving away from edu address verification. Seems like more and more schools now let you keep your edu address permanently.

I almost never see anywhere to easily get educational discounts that doesn't require some kind of verification you are currently a student. Seems like Apple is the only major company without hard verification, but they seem to have a soft policy that allows buying devices at a discount for your child's, niece's, cousin's, etc school expenses

The new hotness for student status verification is ID.me. This is, despite some controversy, still the interface to various US Federal agency sites, and other sites as well. ID.me has a pretty rigorous verification system. They will not only verify your student status, they can verify qualified teachers/educators, HCPs, veterans, and recipients of public benefits. So it's sort of one-stop-shopping for a verification broker who will then introduce you to whatever site wants to authenticate you.

It was interesting, because I happened to graduate from college in May, much to my own surprise, and ID.me soon notified me that my student status had expired. I don't know if it was on a timer-deadline, or linked to the graduation event, but whichever it was, they were on the ball.

LinkedIn uses email addresses to verify employees, for example my own employer set up a thing, but it doesn't accept either of the work email addresses I've been issued, perhaps because we've got "two tiers" of employees and my email looks different from the full-timers'.

And you're right about folks keeping our .edu addresses in perpetuity. I worked for an .edu for 4 months, 24 years ago, and I still have access to, and control of, my email address there, in terms of where it forwards. I have no storage or other access, just the ability to point it somewhere.

I now regularly get messages and a constant banner across GitHub about needing 2FA. I don't want to hook my phone up to another service and I don't consider a phone proper security. I'll move my code somewhere else where they don't force their 'security measures' on me and have bots scraping my code to build an AI to replace me.

You can do TOTP on any general purpose computer.

I can even do it on my calculator

It’s also built into some password managers

what kind of calculators support 2FA?

Any programmable ones with an RTC can be programmed to

Mine is a Casio CG50 and this tool can do it: https://github.com/gbl08ma/utilities

2FA != phone number needed

There are other options

These messages are correct. You need 2FA. Passwords alone are not good enough security.

It doesn't have to be via your phone if you don't want it to be. You can buy a YubiKey or similar, or use something like https://github.com/simnalamburt/macos-totp-cli (I haven't tried it, just the first thing I found in a google search).

> Passwords alone are not good enough security.

This made me think for a moment. Why not, though?

My password manager generates random passwords with numbers, special characters and whatnot with a length of 24 characters. Even I don't know most of my passwords at this point, so what's the problem with (secure) passwords?

Poor application security? That's not really my problem, is it?

edit: to add this. I know that "test123" would be a problem, but my secure passwords can not be guessed by anybody or really be bruteforced. so, what does 2FA really protect me from in those cases?

If someone does happen upon your password, they probably won't also have your 2fa. That's how I view it. Safety in layers.

I think they probably will have my 2fa, because then they've probably pwned my computer.

> You need 2FA.

I don't trust Microsoft with my phone, and I don't want logging into my account to become a pain where I need a key. I'll just take my code elsewhere.

> Passwords alone are not good enough security.

Security will only ever be as good as the weakest part - and I happen to find phones pretty weak.

Here’s a video addressing all that: https://youtu.be/kvTdea7Uh3w

Good for you. I left, too. They don't even offer redirects to a new location of the removed project, lol.

Forced 2FA on everyone is non-sense. Everyone should decide on their own what is enough security. All I had was a Linux repo mirror, with signed tags for tested releases of my kernel branches.

Zero security issues with that distribution method. 2FA is only useful for veryfying user logins, not repo content.

Anyway, they can do whatever they want. GIT is thankfully fully distributed repository management system, so github.com is quite optional.

FWIW gitlab has also done similar.

I think MFA is important for something like code repositories.

Gitlab has the best security. They don't even let me to the login page.

https://megous.com/dl/tmp/egrdxmmfuiakyhkodsok.webm

This is what you get if you pay, too.

> I think MFA is important for something like code repositories.

I think it's not, because they can't be secured by it. As a code user I can't be sure repo was not tampered with, just because some service promises to use 2FA to authorize developer access to the repo.

Dude Facebook did it, twitter requires a phone number, YouTube requires your details in a lot of scenarios. I remember when we were taught to not dox ourselves online, the change in that tone interestingly coincides with the rise in malware being published by these companies. Reddit will do it eventually too.

Enrolling into GitHub education already required a school email which usually contains your name or school documents which most definitely have your name on it.

The change being discussed is not about sharing your name with Microsoft GitHub but about having it on your profile. Your profile is shared to third-party such as apps with the right OAuth scope.

A couple of years ago I verified that they really only just looked for *.edu.* in the domain part of the email address. I could easily enroll with something like john@edu.my.domain.com . I reported it but they didn't give a damn.

While they did not respond to your report. They currently definitely make it hard to pull something like this, as they will ask for real docs to prove that you are a student.

Oh, they did respond, they just wrote that they don't give a damn. I guess they care now. As I remember this was way before the Microsoft acquisition though, so there is that.

Before MS acquisition, they were a small player. The GitHub education pack was much smaller in terms of what it offers than today. This means it was less of an abuse target, and probably some of the contracts between providers and GitHub is that they must have a restricted student verification process. They afforded to ignore that before, but can't today.

Are you saying we should just roll over and accept this? Because somehow these companies have become trustworthy?

No, I thought my malware peddling accusation against them made that clear. I'm saying all the big corp websites are going to do it and you should jump ship now to the real internet, where people still host websites and run services for fun and a little profit on the side. I wouldn't dream of committing new code to github, or having a twitter, Facebook or google account and I can't understand why so many people cling to these honestly mediocre at best websites.

What are they going to do? When they first install their browser (even Firefox!), the default tabs are littered with these malware. Their start menu as well. Ads on TV. News on TV. QR codes and URLs everywhere "visit our instagram page! Follow us on Twitter!"

This IS the Internet for most people... And it was built by people like us who should know better :(

Yup, in my university, lots of things like societies etc. are on instagram and facebook. I don't have any, so I can't really participate. Ah well, it's the price for not getting in the loop of soycial media

I agree in principle but it is basically at the expense of having an age-appropriate social life anywhere that isn't online - ironic.

Practically everything around me in the 20s-30s age range is organised on walled garden social media. I also hear offhand that when seeking relationships you need some online presence or you will be seen as suspicious.

Well, I for one would rather gang around those "suspicious" people, so I see it as selecting for like minded individuals. If someone views me with suspicion for not having a Facebook or whatever I'm perfectly happy saying goodbye. And it works for me, I have a like minded partner that I let IRL in the modern age, she saw it as a plus and that's the kind of person I'm going for.

The problem here, is actually require you to share real name on PUBLIC PROFILE, so everyone can see, not just GitHub employee, I believe this has nothing to do with GitHub needing to verify my identity, it can ask for my personal information privately. By the way, I feel that your point doesn't hold true in other situations as well. Just because someone took my coat, it doesn't mean I should also give them my underwear.

The moment FB started requiring this is the day it started dieing. Everyone moved to Instagram which is also owned by Meta now but doesn't have the requirement.

Facebook has always officially had a real name requirement. The main difference between theirs and the much more famous one which Google+ had is that Facebook has traditionally not been proactive about enforcing theirs, whereas Google engineers controversially made an attempt to implement the official policy in code like any other specification.

(Disclosure: although I worked for Google years ago and did read an internal memo back then from employees which complained about this policy, my comment is not based on any secret internal knowledge. My own job had nothing to do with Google+ or the real names policy.)

I get the desire for privacy and such but considering what GitHub is hosting, if you believe in something you sign your name to it. I don’t mean believe in GitHub but in the projects your keeping on GitHub.

You can put your name out there without doxxing yourself.

I would be more worried about what Google is doing with Chrome than GitHub requiring a name.

What if one were a progressive student in an oppressive country contributing to or writing code for a repo that the regime finds objectionable?

> You can put your name out there without doxxing yourself.

No, you literally cannot in 2023. It's trivial to put together a very comprehensive profile on a person from all the data that has been leaked or is being sold with nothing but a name as a starting point.

> If you believe in something you sign your name to it

I do not see why that should ever be a requirement. You are free to take a project less seriously solely because you don't know the authors' legal names (although this makes literally no sense to me), but why should that be a rigid requirement?

> No, you literally cannot in 2023. It's trivial to put together a very comprehensive profile on a person from all the data that has been leaked or has been stolen with nothing but a name as a starting point.

Or for sale by advertising data brokers!

Yes, I meant to write being sold instead of stolen (I included data theft under 'leaks')!

There is no good reason to. "Belief" is subjective and should not require normalizing an erosion of privacy.

"if you believe in something you sign your name to it"

Without a beat, the next thing from this is "If you believe in this, you deserve to be fired." No thanks.

If you believe what you say in your comments, why don't you use your real name as your username on HN?

>but in the projects your keeping on GitHub.

99.999999999999999% of all open source code has this following statement in some form

>THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED

There is absolutely zero need for a real name and nobody believes in their own code ;)

The fundamental aspect of open source isn't about "believing" in what you are doing. You are simply sharing something you wrote. That's it. The vast majority of people are not trying to save the world by becoming the next JS web framework.

Reply on news.ycombinator.com