151–160 of 277 posts
Earlier quoted context omitted.
It doesn't seem to verify hashes of objects on checkout, but it does when receiving packfiles. So it's difficult to see how this could be an exploit unless the attacker has access to your local .git directory.
If you're syncing the repository itself (e.g. over Dropbox) instead of using git remotes, then it could be exploited.
The two most interesting companies in crypto for me right now are KeyBase, and Wire. I kind of wish there was some way for them to interact with each other, because it feels like they each have a piece of some bigger puzzle.
https://news.ycombinator.com/item?id=14069674
Versus the data Signal collects:
https://signal.org/bigbrother/eastern-virginia-grand-jury/
Although I agree Wire looks like a much more (visually) polished chat service, it seems like they (Wire) collect more data than is necessary.
Earlier quoted context omitted.
The outpouring of positive energy (on HN!) is really inspiring. Everyone on the Keybase team is feeling good about our work right now, so thanks!
The team seriously deserves it. For what it's worth, I think my above comment is my highest upvoted comment of all time. There's a lot of people out there who want Keybase to succeed.
Keybase, please just support web of trust already. In some way. Not everyone I want to be able to authenticate necessarily has public social media accounts.
I have a private repo on GitHub which contains my dotfiles with SSH private keys, tokens, secrets and all kinds of secret stuff. I was uncomfortable storing it there, but my laziness/lack of time kept it there. Finally I will be able to encrypt the entire repo, yay!!
Earlier quoted context omitted.
> You guys should be taking my money, is what I'm saying. Completely agreed. The reason I don't use Keybase more than I do is because I half expect them to be acquired/something else to happen. Would gladly give them my $10/mo. for a 1TB instead of Dropbox. With that said, I completely understand why they aren't right now -- maybe they're not going after the consumer market, maybe they don't want to box themselves in…
For sure. I would give them my ten bucks a month for the 100GB I get for free .
Awesome... any plans to support LFS? I know with LFS you can write custom backend handlers.
Edit: Just tried and no dice: 'Remote "origin" does not support the LFS locking API.'
Was expected one question but haven't found one: how it is actually encrypted? Any whitepaper or information how diffs could be handled over encrypted data? Or it is a just encrypted .git folder?
If you go crypto don't use git. It's not designed for cryptography in mind and the Keybase approach looks nice IF I can control every chain or can keep using github (or any other git server) with it. But for the storing part alone I would not trust Keybase. I would even say if you do crypto and need cloud storage then store it in multiple places and avoid git. Better flat file and some daily backup strategy with e.g.…
> But for the storing part alone I would not trust Keybase. Why not? You're making a bunch of claims about this being bad but you're not providing any reasoning for it.