I am under impression that protecting privacy of user is a "big deal" - even if only declaratively. Example: discussion on meta about e-mail addresses on SO.
Whilst I do expect that sooner or later my e-mail address will leak from some hacked database or contact list, I would nevertheless expect portals to which I give this data to at least try to conceal it from public.
Why then with GitHub I can simply go to .patch file of a commit? From GitHub:
Commits must be made with an email address that has been added to your GitHub profile in order to appear on your contributions graph. You can check the email address used for a commit by adding .patch to the end of a commit URL, e.g. https://github.com/octocat/octocat.github.io/commit/67c0afc1da354d8571f51b6f0af8f2794117fd10.patch:
From 67c0afc1da354d8571f51b6f0af8f2794117fd10 Mon Sep 17 00:00:00 2001 From: The Octocat <firstname.lastname@example.org> Date: Sun, 27 Apr 2014 15:36:39 +0530 Subject: [PATCH] updated index for better welcome message
Why they would allow an impersonation as well? The answer they give here is:
Because Git is a distributed version control system, GitHub must use the commit email address to assign attribution. When you push a repository to GitHub.com it may contain one or more commits, some of which you may not have authored. For example, imagine a scenario where you collaborated with a number of people on a git repository before you made your first push of that repository to GitHub.com. This push would contain a number of commits from several authors. It would be incorrect to assign all of the commits to the person doing the push, so we use the commit log email addresses to assign attribution on GitHub.com. Each subsequent push to GitHub uses this same logic to assign attribution of commit authors.
Why it must use the e-mail addresses? Cannot they obfuscate them? Cannot there be an functionality that you need to explicitly allow a certain repository to link a commit e-mail with your account? Simply giving the option to impersonate is an acceptable alternative?
Perhaps I am heavily confused here being new to GitHub and programming itself, but it seems that GitHub is a public repository of e-mails and I find it somewhat shocking. Also if you have an e-mail address you may check if someone uses it on GitHub. If you have a linked user name you can half expect that the same nickname might be use elsewhere (e.g. SO) since, I think, there is no recommended good practice of using varying usernames on different portals (like there is for passwords).
Is then what GitHub is doing a commonly accepted practice?