10

When submitting a paper to a conference/journal for double-blind peer review, one usually has to anonymize source code, if there is any. In my situation, I have to do it in a form of GitHub repository. I know that people often do it using anonymous GitHub accounts. However, it seems inconvenient to me, and I am trying to achieve the goal using a GitHub organization, created from my main account. My question is: can you identify me given the following setup?

  1. This is me: https://github.com/Yura52
  2. This is my organization: https://github.com/Organizationnnnn
  3. This is the repository with one my commit: https://github.com/Organizationnnnn/first

NOTE: if you want to use this workflow, don't forget to:

  • remove yourself from watchers right after you created the repository
  • set user settings after you clone the repository:
    git clone https://github.com/Organizationnnnn/first
    cd first
    git config user.name "Anonymous Author"
    git config user.email "[email protected]"
    touch README.md
    git add README.md
    git commit -m "anonymous commit"
    # you can also anonymize yourself only for specific commits, but there is always a risk of forgetting this
    # git commit -m "anonymous commit" --author="Anonymous Author <[email protected]>"
    
3

2 Answers 2

3

The fact that you created the repository is visible under your account's activity, so anyone following your account can see it in their feed. This can also be seen later by viewing your activity by subscribing to your RSS Feed.

However, generally this should be a concern for anonymizing for peer review, since the requirements are usually much lower — authors can often be identified by preprints and similar means anyway if someone really wants to find out, and reviewers are expected not to go looking for this information.

But if you have a GitHub account with a lot of followers or want to prevent anyone from checking if your account created the repository, then your proposed method is not sufficient.

6
  • Oh, I see. One of my followers confirmed that: the fact of creation of the repository (but not of organization) is visible. I tried the following fix: 1) create an anonymous user 2) invite this user in my organization ("Organizationnnnn" in the original example) 3) create repositories on behalf of the anonymous user. It doesn't add anything to my activity feed and I can "manage" the repository from my main account (since I am the owner of the organization). What do you think?
    – StrausMG
    May 24, 2021 at 17:32
  • @StrausMG AFAIK your pushes (not the same as commits) are also available in the RSS feed, so I am not fully sure if you can manage using your regular account. I think the suggestion by @ Anyon is worth looking into, btw.
    – GoodDeeds
    May 24, 2021 at 17:46
  • @StrausMG Also, if you're anyway creating a separate anonymous account, you might as well stick with it. You can create a separate SSH key for that account and set your git config so you don't need to worry about passwords or anything.
    – GoodDeeds
    May 24, 2021 at 17:48
  • Yep, there are some 3-rd party tools, but I was trying to solve the problem without them. Sorry, I should have said that in the beginning. Thank you for the answer.
    – StrausMG
    May 24, 2021 at 18:02
  • as for pushes, I can see "Yura52 created a branch master in Organizationnnnn/first" in my RSS feed. I think I am ok with that, because my main concern is the activity that is visible in UI.
    – StrausMG
    May 24, 2021 at 18:08
1

You should check out Anonymous GitHub . It comes with a set of limitations:

What are the limitations of Anonymous GitHub?

Anonymous GitHub does not allow to download the repository.
Anonymous GitHub only anonymizes textual files.
Anonymous GitHub does not support files that are larger than 8Mo.
The anonymization can change the behavior of the program.

But it is probably more reliable than any "hack" you could come up with.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .