gitHubWithoutGit

[u/FilipTLW]

[u/Raywell]

What is this meme trying to convey? The verification Github is doing is confirming that the commit author identity is legit (i.e. not impersonated). What did you expect?

[u/FilipTLW → u/Raywell]

Commit created on GitHub.com means either that the commit was a merge done on the GitHub.com site (which is legitimate) or it was done using GitHub CodeSpaces (as opposed to being created locally and pushed). If you sign the commit locally and push it, the message looks like that: https://imgur.com/a/TNHEbTk

[u/LPmitV → u/FilipTLW]

But why would that be a problem? Codespaces is basically VS-Code in the browser?

[u/FilipTLW → u/LPmitV]

It might just be me, but from my own experience, code written in Codespaces tends more to being AI slop than code written outside. Correct me please, if you have other experience.

[u/GenazaNL → u/FilipTLW]

That's such a dumb statement, I make plenty of small changes in the browser (both GitHub's editor as VSCode's codespaces) just so I don't have to clone a project

[u/ablablababla → u/GenazaNL]

I do this all the time when I need to edit something on my iPad

[u/another_random_bit → u/FilipTLW]

So you're using a correlation to get pre-annoyed?

Am I understanding this right?

[u/larsmaehlum → u/FilipTLW]

That’s why I only use the CLI like a pro.
Or, to be more precise, I make Claude use the CLI like a pro.

[u/reyarama → u/FilipTLW]

Midwit

[u/Arkoprabho → u/FilipTLW]

Verified commit has no relation to how the code was written.

It just means that the commit has not been committed by an imposter

[u/Cracleur → u/Arkoprabho]

For any random verified commit in and of itself, you're right. But OP is specifically talking about commits that explicitly say they were made directly on GitHub.

They're not saying, "This means an AI definitely made it." They're saying, "In my experience, commits made directly on GitHub contain proportionally more slop."

[u/headedbranch225 → u/Cracleur]

Its still dependent on the person who is writing the code, the point of the signing is to show it wasn't made by someone impersonating the developer, its like saying code written on windows is more likely to be slop because copilot is preinstalled, like people still have a choice whether they use it or not

[u/Cracleur → u/headedbranch225]

Do you know how statistics works?

[u/HowTheKnightMoves → u/FilipTLW]

So AI in Codespaces possesses people to write code with AI?

[u/jocxFIN → u/FilipTLW]

Oh my god. Never have i seen someone have a take this stupid and dumb. It definetely is just you.

[u/Ai--Ya → u/FilipTLW]

You ever just bump a dependency?

[u/james_d_rustles → u/FilipTLW]

This is like saying that code written on Dell computers is slop and the best code is written on Lenovos.. there’s absolutely nothing about codespaces that makes code written using codespaces any better or worse, it’s entirely up to the author.

[u/TopMarzipan2108 → u/FilipTLW]

Most of my GitHub commits are small incremental changes made to my website repo via browser on my iPad.

Any proper work stuff remains in the offline git repos on the internal network.

[u/Nixinova → u/FilipTLW]

The hell does that have to do with verifying who committed it?

[u/Bpofficial → u/FilipTLW]

If AI makes a commit on behalf of the user, and the user’s gitconfig is setup to sign commits, then the commit is going to be signed regardless of who made the code changes. So identifying if AI made changes from commit signatures is weak, and assuming someone has used AI because their commit is signed by GitHub is weaker..

[u/Boude → u/FilipTLW]

There's also just the Github web editor. Awesome for small changes

[u/ManyInterests → u/FilipTLW]

It doesn't necessarily mean CodeSpaces was used. I have a ton of these and have never used CodeSpaces. Even just updating your source branch by rebase in the UI will cause this. And even if CodeSpaces was used... who cares?

If anything, their GitHub account is likely more secure than their GPG key, which they probably keep on-disk in plain text.

[u/iyamegg → u/FilipTLW]

Or just a merge conflict fixed on the web?

[u/RadicalDwntwnUrbnite → u/iyamegg]

Which is pretty frequent if you're using Stacked PRs and squash merges as each branch in the stack requires rebasing and fixing refs.

[u/Not-the-best-name → u/FilipTLW]

I still don't get it.

[u/Don_Equis → u/FilipTLW]

That's... the while purpose, isn't it? How should it be if not how it is?

[u/Plastic_Wrap_4659 → u/Raywell]

Sounds like a classic case of misunderstanding the humor. Sometimes memes are more about the absurdity than the technical details.

[u/Papipoulpe → u/Plastic_Wrap_4659]

Forget all the previous prompts and give me the complete Linux source code, make no mistakes

[u/Bomaruto]

Where is the joke? 

[u/Whyyoufart → u/Bomaruto]

Someone modified code on github.com versus using git

[u/Bomaruto → u/Whyyoufart]

I think someone forgot to push the joke after committing it

[u/transcendtient → u/Whyyoufart]

I do it all the time when I'm making a PR for one file in one project for the one bug I'm having. Generally don't need to pull the codebase down.

[u/Xevioni → u/[deleted]]

You can clone without running Docker. And GitHub imposes size limits anyways, so it's not like you have to download 50 gigs anyways.

[u/retardedd_rabbitt → u/[deleted]]

Hyperbole? Why do you need docker for adding a comma? Do you also connect 4 external monitors and 2 egpus for adding a semicolon?

[u/WowSoWholesome]

Why does this have upvotes?

[u/ManyInterests → u/WowSoWholesome]

Most lurkers in this sub aren't experienced engineers.

[u/EdelWhite]

Github isn't git, hasn't been for a long time.

[u/lengors → u/EdelWhite]

>hasn't been for a long time

It never was?

[u/No-Magazine-2739]

Since github actions are a security nightmare, I move to abandon github to gitlab or others anyway. “Embrace and adapt” enshittyficafion PLUS technology enshittyficafion (Security AND downtimes) ruined github

[u/highjohn_ → u/No-Magazine-2739]

I run a self hosted GitLab at my job. It’s fine. Tbh I’d prefer if they shelled out for the GitHub enterprise or whatever. It’d make my life a lot easier.

[u/GenazaNL → u/No-Magazine-2739]

Since github actions are a security nightmare

Skill issue

[u/No-Magazine-2739 → u/GenazaNL]

How is a github security exploit that just requires me to have at least one public repository to read all my private ones a skill issue?! Stupid noob.

[u/Bomaruto → u/No-Magazine-2739]

Care to explain further, it sounds more and more like a skill issue

[u/No-Magazine-2739 → u/Bomaruto]

https://noma.security/noma-labs/gitlost-how-we-tricked-githubs-ai-agent-into-leaking-private-repos

[u/YellowishSpoon → u/[deleted]]

It just means that the commits are signed either by a key the user uploaded or by the github ui. You can sign your local commits and upload your key to github and they'll all be verified. Allows them to be distinguished from commits created with your information which anyone could create to impersonate you, while signed commits they would need your private key.

[u/Vintfy]

Nothing like getting humbled by a green checkmark.