Last night, a scary looking message came to me from our Slack channel:
We were referring to the user as “Devil Man” because this was his profile picture.
After wondering if perhaps my ssh keys had been compromised, I came across something that makes way more sense, and isn’t sinster at all. I ran the following command on my laptop:
Corys-MacBook-Pro-2:~ foyc$ git config --list
user.name=BuildTools
user.email=unconfigured@null.spigotmc.org
Turns out, I have a new laptop that I haven’t configured with all my dotfiles, etc. However, I was playing around with a Minecraft/Raspberry Pi server, and pulling down the tools set my global Git configuration. Since I didn’t change it to anything else, the PR I sent got pushed up with the above as the configuration, and “Devil Man” must have that as his GitHub repository email, so GitHub helpfully linked the two.
Thankfully this wasn’t a security vulnerability per se, but in case you ever wonder why your commits are attributed to Devil Man, now you know that it isn’t his fault, but your own for not configuring your commits properly.
(For futher reading, GitHub has a more boringly titled article “Why are my commits linked to the wrong user”)