GitHub Classroom: Timecode cheating

Hello, I’m a teacher at an university in Germany. I will provide a short explanation of what we planned to do, and conclude with the problem we recently ran into.

The Story

In our current term we use GitHub Classroom to manage the repositories of our students. Since the forth homework we use a repository without a deadline for an ongoing development process of an application. Each homework sheet has a deadline written on it. The deadline is always Thursday evening at 11:59 p.m. the following week.

A student came to us last week to discuss his submissions. Each of his 3 submissions where committed Friday night at around 00:50 p.m. This leads to 3 failed attempts in our course, which is why he no longer can attend the exam this semester.

He claimed that he did not miss the deadline but, due to the time difference of his home country and Germany, set his time an hour ahead. He claimed that this was the reason why his commits seemed to be not in time.

While looking at his time settings to see if he is straight up lying to me, I realized he hadn’t changed the time zone to match his home country, but that he manually set the time of his laptop an hour ahead.

At this time I still thought he is trying to fool me. I set up a test repository, committed some stuff and proceeded to manually set the time of my laptop one hour ahead. I committed again and proofed his assertion. The last commit in my repository had a timestamp that was one hour ahead of the actual time. It even got better when I pushed it to a remote repository, set my time back to normal and refreshed GitHub. My last commit was then tagged to be ‘committed in 1 Hour’. First of all, yay time travel, but still, this is a problem.

Steps to recreate

  • Git init
  • Commit stuff
  • Set time an hour ahead
  • Commit again
  • Push to remote repo on GitHub
  • Set time back to normal
  • Refresh GitHub and feel like Marty McFly

The Problem

How can I retrace when the student actually pushed his work?

The first trace of hope I found online was to look into the push logs of GitHub, but I’m no admin of GitHub.com, so I can’t do that.

The second attempt was to use the ‘git reflog’ command, but when cloning the repo the only entry is the clone I just performed.

Questions

  • Is there a way to see the Push Logs on GitHub or GitHub Classroom without being an admin for the site?
  • Is there a clone command that also copies the origin logs? In this case I would be able to use the ‘git reflog origin’ command to see the push timestamps right?
  • Is there a better way to manage this kind of weekly deadlines with GitHub Classroom or do I have to build my own cloning scripts?
1 Like

Hey @ClemensEmme!

The nature of Git doesn’t allow us to ensure when a commit was actually written based off of the Git log alone. Like you’ve noted, it’s easy to change the timestamp of a Git commit. Also, there are normal Git workflow commands like rebase which change history and can rewrite past commits to have a more recent timestamp, making it seem as if all work was done after the deadline.

This is why our deadline feature ignores the Git log completely, it’s not trustworthy. When the deadline hits, our server fetches the latest commit from the master branch of each repo, and stores the SHA. The cryptographic nature of Git makes it so if the student updates that commit with new work, the SHA will change, so it’s impossible for the student to “fake” recent work as being submitted before the deadline.

The most simple solution might be to just use the deadline feature.

  1. Set the assignment deadline to be the first deadline
  2. When the deadline passes, grab the commit SHAs captured by GitHub Classroom (they’ll be accessible in the GitHub Classroom assignment view)
  3. Set a new deadline on the same assignment. The assignments on Classroom will now show as not past the deadline, and the submission SHA will be re-captured when this new deadline hits.
  4. Repeat for as many deadlines as you need.

This is kind of hacky, and we’re looking into building a better experience around multi-deadline assignments. I’ll post an update here when we make progress :slight_smile:

2 Likes

Not to be a jerk here, but this is kind of ridiculous. What the deadline setting should actually do is simply change all of students’ privileges on their own assignment repos to Read instead of Write. Then it doesn’t matter what timestamp is on whatever commit because they can’t even push to the remote after the deadline. Then as instructors we can clone down whenever we have the chance and the repo is in whatever state they were forced to leave it right at the deadline.

When initial grades have been returned, then the repositories should be able to be opened back up for late submissions.

Maybe this is too specific to my personal workflow, but seeing the few questions posted about deadlines and why they don’t actually matter makes me think something like this is really needed here…

© 2017 GitHub, Inc.
with by
GitHub Education