How to anonymize your GitHub activity
Tags: github, anonymous, opensource, vcs
Published: 2019-08-31 17:26:18

Ever wished to hide your identity in GitHub?. Most times you want exactly the opposite. When you're giving your time for free to help open source projects move along, you at least want to be recognized for that (and if this opens the door to possible employment opportunities, even better).

But sometimes be anonymous in GitHub is a requirement (at least for a while). Let me give you <strong>three examples of situations where being anonymous is desired</strong>:
<ul>
 	<li>When you collaborate in projects that may be <strong> competitors to your current company </strong> (e.g. an open-source alternative to the proprietary software your company is selling)</li>
 	<li>Or when you're a woman or, in general, belong to <strong>any kind of collective that could suffer negative discrimination</strong> in the evaluation of their work. In that case, unfortunately, there is real evidence that your work may be <a href="https://www.theguardian.com/technology/2016/feb/12/women-considered-better-coders-hide-gender-github" target="_blank" rel="noopener noreferrer">evaluated with a negative bias</a>.</li>
 	<li>You are a researcher and need to submit the results of your work (including the code to be able to replicate them) to a conference or journal for its evaluation. If the even is using a <em>double-blind review</em> evaluation method,<strong> reviewers should not be able to know or guess who you are</strong>. Obviously, hiding your name in the text of the article but then sending a link to your GitHub repo, reviewers will know your identity which defeats the purpose of a blind review (and even worse, your work could be immediately rejected because of that).</li>
</ul>
Note that each of the scenarios above is slightly different. In the last one, we want to anonymize the full repo. In the others, only our contributions to other repos. Also, in the first scenario, we want to keep our identity hidden forever (or a least for a long time), while in the other two, anonymity is just a temporal situation and we want to reveal our identify once the work has been evaluated. I will show a couple of solutions for each case. But to be clear, none is perfect. It's more a matter of making it difficult to know (or guess) who you than making it completely impossible.
<h2>How to anonymize a GitHub repo</h2>
<a href="https://github.com/tdurieux/anonymous_github/" target="_blank" rel="noopener noreferrer">Anonymous Github</a> is a proxy server to support anonymous browsing of Github repositories for open-science code and data.

Instead of sending a link to your repo, you clone it with this service and send the link to their hosted version of the repo generated under the domain  <a href="https://anonymous.4open.science/" target="_blank" rel="noopener noreferrer">https://anonymous.4open.science/</a>.

Beyond anonymizing the URL, this service also hides the Github owner, organization, repository name and, given a set of forbidden words, (like your name or that of your institution) it makes sure those words are not found in the README, file contents or filenames as you can see in this short animation.

<a href="http://livablesoftware.com/wp-content/uploads/2017/11/anonymousgithub.gif"><img class="alignnone size-full wp-image-118489" src="https://livablesoftware.com/wp-content/uploads/2017/11/anonymousgithub.gif" alt="Anonymize a full GitHub repo" width="800" height="450" /></a>
<h2>How to anonymize your contributions to GitHub projects</h2>
There are two options I know of: <a href="https://www.gitmask.com/" target="_blank" rel="noopener noreferrer">GitMask</a> and <a href="https://github.com/anonydog/anonydog" target="_blank" rel="noopener noreferrer">Anonydog</a>. Both work in a similar way: they submit the Pull Requests on your behalf (and under their name) and take care of anonymizing your personal data (name, email, even timestamps) from the commits. While as we discussed above, this could prevent your PRs to be rejected based on your personal profile, it could also happen that the project decides to systematically reject anonymous PRs.

The main difference between the two is that with Anonydog you can, later on, reveal your real identity. Another difference is the way they need to be setup. With Anydog you need to first ask it to fork the project you plan to contribute to and then work on that forked version. With gitMask you work on your own and when ready you submit to gitMask a <a href="https://git-scm.com/docs/git-bundle" target="_blank" rel="noopener noreferrer">git bundle</a> to anonymize.

<a href="http://livablesoftware.com/wp-content/uploads/2017/11/anonydog.png"><img class="alignnone size-full wp-image-118488" src="https://livablesoftware.com/wp-content/uploads/2017/11/anonydog.png" alt="Anonymize your pull requests in GitHub" width="962" height="515" /></a>
<h2>Other alternatives to be in GitHub under an "incognito mode"</h2>
A more "exotic" way to be anonymous implies using <a href="https://www.torproject.org/projects/torbrowser.html.en" target="_blank" rel="noopener noreferrer">Tor</a>. For instance, this project explains how to <a href="https://github.com/chr15m/gitnonymous" target="_blank" rel="noopener noreferrer">submit anonymous commits over Tor</a>. A more extreme alternative is to<a href="https://motherboard.vice.com/en_us/article/mg7aea/theres-a-dark-web-github-for-controversial-code" target="_blank" rel="noopener noreferrer"> move the full collaborative development process to the "deep web"</a> for software projects that are controversial.