Re: Git Privacy

From: nick <nick@nicholasjohnson.ch>
Date: Jul 15, 2023, 04:32 UTC
Message-ID: <CU2GQHQV5GD3.CL67078EF4OO@anonymous>
In-Reply-To: <xmqqbkgeqw6n.fsf@gitster.g>

Junio C Hamano wrote:

Show 13 quoted lines

> "nick" <nick@nicholasjohnson.ch> writes:
>
> > However, I think it is worth the effort for the time zones. Is there any
> > reason Git doesn't automatically convert local time to UTC in timestamps
> > to prevent leaking the developer's time zone?
>
> Actually it is the other way around, if I understand correctly.
>
> Git could have been designed to discard that information like
> previous version control systems, but it is another piece of
> interesting information and made a conscious design decision to keep
> it. In other words, "is there any reason why we do not discard the
> information?" is a wrong question to ask in the context of VCS.

I'll make my best case one last time and if it doesn't convince you, then I have nothing else to offer.

Git leaks private information about developers publicly by design through its precise timestamps. You mentioned this makes it easier to deny copyright claims, but one could get more or less the same benefit without sacrificing privacy by rounding commit times to the nearest day. I'm not advocating making this behavior the default, just that developers be given the option to do it.

The time zones reveal private information about developers and they don't even serve a use case, as far as I'm aware. A backwards-compatible way to solve this leak would be to convert timestamps to UTC by default and have a Git config option to revert back to the current behavior.