111–120 of 121 posts
Earlier quoted context omitted.
here's some more: https://keybase.io/inv/e2d4bf61e4 https://keybase.io/inv/c04b18c7c3 https://keybase.io/inv/e0f10b0fea https://keybase.io/inv/ab432f0ab7 https://keybase.io/inv/923f343c20 https://keybase.io/inv/27a2dbe5ee https://keybase.io/inv/6dc9197192
only 1 left of these: https://keybase.io/inv/c04b18c7c3
Earlier quoted context omitted.
Linus has a point, but it's not without flaws. Linus is saying that it makes you complacent, and doesn't prove anything about any release, and that you should sign golden commits. He says this because only what is shipped needs to be trustworthy; and the value of a signature degrades with the more things it signs. This raises the question, though; how do you know when you reach that golden commit? Is the signer respo…
I was also told that having a signature on every commit makes pulling the entire repo take forever (because it has to validate every commit). Not sure how true that is.
Earlier quoted context omitted.
That would be the second hardest problem in PKI: key escrow and key management. The answers to the questions most average users have like: What do I do if I lose my machine? If I'm logged in from the library or work or my friend's PC? If I use multiple machines every day? When the "right" answer includes "Print out this long thing, put it in a safe deposit box, and pray you never have to type in this long string of n…
My grandparents don't even use email. I don't think we should be setting them as the lowest common denominator for security. Some things that are worth doing require a little bit of effort.
Earlier quoted context omitted.
My grandparents don't even use email. I don't think we should be setting them as the lowest common denominator for security. Some things that are worth doing require a little bit of effort.
You have have to consider the lowest common denominator in security. You're security it's only as good as your weakest link. Say you have an emergency and your grandparents need to email your PII to a hospital. Can they do it securely? You need to email some PII to them. Can you do it securely? Some security for all is better than no security for most, hence the "grandparent test".
Earlier quoted context omitted.
Invites: https://keybase.io/inv/4c100c57c9 https://keybase.io/inv/89cb21a5a6
More Invites: https://keybase.io/inv/34fda59c6f https://keybase.io/inv/27f71dd95c https://keybase.io/inv/0ba37842db https://keybase.io/inv/105ba8ef1e https://keybase.io/inv/070ed67897 https://keybase.io/inv/b5f6094a85 https://keybase.io/inv/5f77883740 https://keybase.io/inv/0cec6fa3d9
Earlier quoted context omitted.
More Invites: https://keybase.io/inv/34fda59c6f https://keybase.io/inv/27f71dd95c https://keybase.io/inv/0ba37842db https://keybase.io/inv/105ba8ef1e https://keybase.io/inv/070ed67897 https://keybase.io/inv/b5f6094a85 https://keybase.io/inv/5f77883740 https://keybase.io/inv/0cec6fa3d9
Only one left: https://keybase.io/inv/070ed67897
Linus Torvalds, the creator of Git, says that signing every commit is stupid. http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-t...
And as noted nearly every time this 7-year-old comment by Torvalds is mentioned, this is of course technically correct due to the properties of git's Merkle tree, but completely impractical as far as the human implications. Consider: You've just written 20 lines of code, and you're creating a commit. Can you validate that all 20 lines were created by you before you commit? Now, consider that you're looking to create…
Earlier quoted context omitted.
And as noted nearly every time this 7-year-old comment by Torvalds is mentioned, this is of course technically correct due to the properties of git's Merkle tree, but completely impractical as far as the human implications. Consider: You've just written 20 lines of code, and you're creating a commit. Can you validate that all 20 lines were created by you before you commit? Now, consider that you're looking to create…
If you autosign every commit then you aren't validating anything anyway. All that means is you have another mindless process running automatically in the background. So what's your point?
1. Someone got access allowing them to push commits.
2. Someone got access allowing them to push commits and also got unrestricted access to the trusted PGP key.
In the first case, auto-signing will expose the issue. In the second, not. But in the second case, you're likely screwed in many other ways.