101–110 of 121 posts
I also have a couple of keybase.io invitations: https://keybase.io/inv/23d5ce3afc https://keybase.io/inv/bb28df44d6 https://keybase.io/inv/bb9c4fffa8 https://keybase.io/inv/471c1f67b7 https://keybase.io/inv/44968be986 https://keybase.io/inv/cd6c91d01e https://keybase.io/inv/cdc45eb48f https://keybase.io/inv/41d268d0d6 https://keybase.io/inv/b74615140f https://keybase.io/inv/d90ac04ed3
Earlier quoted context omitted.
Fair enough, when it comes to coming up with creative ways to solve the web of trust problem. I still do not know what problem keybase.io solves when they allow uploading of private keys.
That would be the second hardest problem in PKI: key escrow and key management. The answers to the questions most average users have like: What do I do if I lose my machine? If I'm logged in from the library or work or my friend's PC? If I use multiple machines every day? When the "right" answer includes "Print out this long thing, put it in a safe deposit box, and pray you never have to type in this long string of n…
I'm not sure keybase does this by default, but make sure to upload your key to a keyserver such as MIT's ( https://pgp.mit.edu ). Otherwise, git will complain that the signature is invalid when doing `git log --show-signature`.
Why would I want to sign all (any?) of my commits? Releases sure, but every single one? What's the point? Tangentially on topic, when did keybase get that terrible logo? It looks like it'd be the mascot for an off-brand bag of potato chips.
Signing every commit is a much easier guarantee to make: "this change was made by me and I trust this change". In aggregate it's much better than just having signed releases (though of course you should sign releases in addition to this).
Somebody please explain to me: What's the point in signing on github when I can set the key on github itself (e.g. account gets compromised). A simple flag (on github's server) that is showing that my email on commit is the same as on the account would also do the job. What if my key is compromised and set a new one on github? What happens with my old signed commits? Another question: We are mostly no airplane mechan…
They could verify who pushed it to github, since that action is authenticated, but restricting pushing other people's commits would break many workflows (eg, a bot pushing from a local git server), or a reviewer pushing code sent to a mailing list, or resolving conflicts in a merge locally.
You can also verify the GPG key independently of Github. Perhaps your CI system could verify all commits it builds are signed, and your deployment system could too. There's no need to use Github as the authoritative source for that sort of thing.
Linus Torvalds, the creator of Git, says that signing every commit is stupid. http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-t...
Linus has a point, but it's not without flaws. Linus is saying that it makes you complacent, and doesn't prove anything about any release, and that you should sign golden commits. He says this because only what is shipped needs to be trustworthy; and the value of a signature degrades with the more things it signs. This raises the question, though; how do you know when you reach that golden commit? Is the signer respo…
Earlier quoted context omitted.
Keybase would prefer to handle your private key too. You can work with your key offline too, but you have to be aware that this is what you want when setting up- and it's very much not the happy path, so the site will not fully work as you might expect. Not faulting them, they provide the steps needed, but it might be annoying enough for some people to start uploading private keys.
I've signed up a long time ago (yay early adopters I guess), so I can't comment on the sign up process or setup with your own GPG key nowdays. But their website works 100% and provides all the functionality if you don't let them host the private key (they give you an easy-to-inspect snippet to paste into your terminal that downloads/signs/uploads things for them. Note, it does do anything when you paste - you need to…
Earlier quoted context omitted.
So do I :) https://keybase.io/inv/8cc6068c31 https://keybase.io/inv/345f0dd4e2 https://keybase.io/inv/2d06418590 https://keybase.io/inv/73fd612897 https://keybase.io/inv/1e9acdc815 https://keybase.io/inv/d5ae0a4b0c
Invites: https://keybase.io/inv/4c100c57c9 https://keybase.io/inv/89cb21a5a6