I'm not going to cryptographically sign my Git commits, and you shouldn't either • Hacker News Board

Re: I'm not going to cryptographically sign my Git commits, and you shouldn't either

#11

Post by nusl » Sun, Mar 03, 2024, 7:12 PM UTC

fxtentacle wrote: post #4

nusl wrote: post #3

I don’t fully understand the argument. The article is rambling and touches so many topics in different ways such that I can’t really see a clear analogy or connection. What I gathered was that the author believes signing commits to be bad because; 1. It adds complexity that you otherwise don’t need 2. GitHub is the only place that cares or enables this and we don’t want to add to their Git monopoly 3. Signing the com…

I thought the article was quite clear: Signing a commit creates an expectation that you approved of the code. And it's permanent, so easy to screw up with lasting effects. But a signed commit really just means that whoever created it could run a CLI tool on your computer. That means the expectation of quality created by signing is misleading.

If you’re equating signing a commit to traditional code approval you fundamentally misunderstand the point of signing a commit or what a signature is in cryptography. You “approve” the code by authoring the commit but the signature is a verifiable stamp to say it was you, not the approval itself.

In that case you probably need training or self-education. If your company tells you to sign commits but doesn’t tell you why, that’s on them. If you sign commits and don’t take the time to understand why, that’s on you.

Also, if you think quality comes from approval or signing a commit you’re also not understanding code quality because there is a huge amount of terrible approved code out there.

Just because someone doesn’t understand something doesn’t mean it’s bad or shouldn’t happen. It means that there’s possibly a gap that’s causing the misunderstanding that should be addressed, or the wording changed to be less ambiguous.

Re: I'm not going to cryptographically sign my Git commits, and you shouldn't either

#12

Post by nusl » Sun, Mar 03, 2024, 7:17 PM UTC

salawat wrote: post #10

nusl wrote: post #3

I don’t fully understand the argument. The article is rambling and touches so many topics in different ways such that I can’t really see a clear analogy or connection. What I gathered was that the author believes signing commits to be bad because; 1. It adds complexity that you otherwise don’t need 2. GitHub is the only place that cares or enables this and we don’t want to add to their Git monopoly 3. Signing the com…

I'll sign the commit. I'll also post the private key, because one of my dreams is to as fully enumerate the space of public/private keypairs as possible! Now everyone is happy right? Lets be real. It's more about people wanting a blame ratchet. It doesn't increase trust. And I 100% accept the reasoning that Github is something to be avoided. I will not continue submitting tokens to Microsoft's datasets.

I agree that GitHub is to be avoided. At present it’s a bit difficult and maybe a bit unrealistic to avoid it entirely unfortunately. But I really want the space to diversify more.

Re: I'm not going to cryptographically sign my Git commits, and you shouldn't either

#13

Post by nusl » Sun, Mar 03, 2024, 7:20 PM UTC

1attice wrote: post #6

nusl wrote: post #3

I don’t fully understand the argument. The article is rambling and touches so many topics in different ways such that I can’t really see a clear analogy or connection. What I gathered was that the author believes signing commits to be bad because; 1. It adds complexity that you otherwise don’t need 2. GitHub is the only place that cares or enables this and we don’t want to add to their Git monopoly 3. Signing the com…

Agreed about the writing quality (lack of focus). I thought the bit about liability was a stretch; I don't think this guy is a lawyer, so I'm not sure why he thinks he's in a good position to assess. Generally, I think signed commits are a good thing and mitigate GitHub's centrality, as currently, the only proof that Bob Fooman did a specific commit is that GitHub permitted it to occur with the given email address. E…

Thanks, well said. A lot of security things are quite abstract and difficult to measure the value of.

Often the value is only apparent when stuff goes wrong - “wow we’re lucky we made folks use 2FA because it saved our business” - but if you do it right you hopefully don’t end up with stuff going wrong and then also not reveal the actual value of prevention.

So you end up in a weird sort of limbo of “that will never happen to my company!” Until it does. Then it’s top priority and “why were we not doing this all along?! Our people are idiots!” Except the people saying that were also the people that dropped the security budget and cancelled the security projects and initiatives.

Re: I'm not going to cryptographically sign my Git commits, and you shouldn't either

#14

Post by 1attice » Sun, Mar 03, 2024, 8:42 PM UTC

nusl wrote: post #13

1attice wrote: post #6

Earlier quoted context omitted.

Agreed about the writing quality (lack of focus). I thought the bit about liability was a stretch; I don't think this guy is a lawyer, so I'm not sure why he thinks he's in a good position to assess. Generally, I think signed commits are a good thing and mitigate GitHub's centrality, as currently, the only proof that Bob Fooman did a specific commit is that GitHub permitted it to occur with the given email address. E…

Thanks, well said. A lot of security things are quite abstract and difficult to measure the value of. Often the value is only apparent when stuff goes wrong - “wow we’re lucky we made folks use 2FA because it saved our business” - but if you do it right you hopefully don’t end up with stuff going wrong and then also not reveal the actual value of prevention. So you end up in a weird sort of limbo of “that will never…

Agreed.

Also, I just found this. This current, ongoing attack against GitHub is nicely mitigated by signed commits. If everyone signed commits, before cloning a repo, you could check to see if (a) the author of the fork added anything of value and (b) if the author of the fork has added anything else of value to GitHub, and (c) who signed the majority of the commits to the project.

https://arstechnica.com/security/2024/02/github-besieged-by-...