Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase launches encrypted Git

keybase.io

Post reply on HN
Print view View original

121–130 of 277 posts

Re: Keybase launches encrypted Git

#121

Post by edraferi »

notheguyouthink wrote: post #43

As an aside, does key base offer tools to encrypt data from code, lets say from Python/Go/Rust/etc, that is moron proof? I say tools, because while a library would be cool, I'd understand if it was a binary/application to provide the functionality/user-experience that key base is aiming for. I know this likely doesn't sound like something key base should be aiming for, but to me, programmers need encryption just as m…

Keybase has a public API [0]. There's a community Python library, but it appears to be unmaintained [1].

[0] https://keybase.io/docs/api/1.0/intro

[1] https://github.com/adamldoyle/python-keybase-client

Re: Keybase launches encrypted Git

#122

Post by pkamb »

eridius wrote: post #106
ericfrederich wrote: post #17

This removes the ability for collaborating, browsing online, basically any feature of GitLab/GitHub/BitBucket. ... I think I'm in favor of this. I think of the things that those services provide on top of Git should actually be ported or mapped to Git itself. Branches, pull requests, comments, etc... should all be Git objects of some sort.

GitHub pull requests actually are exposed as git objects (not the comments though, just the commits that make up the PR). If you want to see the commits in PR #515 you can just `git fetch origin pull/515/head`, or `git fetch origin pull/515/merge` to get the merge commit GitHub created when testing if your PR can be merged into the target branch.

Is this possible if the PR is coming from a fork?

Re: Keybase launches encrypted Git

#125

Post by andrewla »

dahart wrote: post #97
eropple wrote: post #10

Earlier quoted context omitted.

So I love Keybase unconditionally and if you guys weren't rolling in physical offices (and not one in Boston) I'd have been beating down your door to come work there--I think what Keybase is doing is important and it's something I'd love to work on. But I have a serious question that maybe you can answer, and it's something everybody who I've showed this to has asked me: How is Keybase gonna make money? How am I assu…

@malgorithm's answer is fantastic, just wanted to add some side-comments... > How am I assured [?] You're not, even if they start making money. Sucks, but true. > You guys should be taking my money One way to pay, if you want to help ensure their success & longevity, is to evangelize for them, and get other people hooked on their product. Getting other people hooked on it like you are and seeing the potential and get…

It's valuable, but not in the capital sense. Each person you get hooked on their product increases their burn rate, and both makes them more attractive as an acquisition (which is scary for users) and more desperate for cash (which makes acquiescing to acquisition more tempting).

Without a road to profitability (or at least a road to revenue) even attracting equity is difficult; investors who enter with that knowledge will be looking to exit through acquisition, since that's basically the only way to exit, other than just getting more capital.

Re: Keybase launches encrypted Git

#127

Post by hamandcheese »

notheguyouthink wrote: post #43

As an aside, does key base offer tools to encrypt data from code, lets say from Python/Go/Rust/etc, that is moron proof? I say tools, because while a library would be cool, I'd understand if it was a binary/application to provide the functionality/user-experience that key base is aiming for. I know this likely doesn't sound like something key base should be aiming for, but to me, programmers need encryption just as m…

Check out libsodium/nacl. Go has an implementation of the box api[0] which is pretty foolproof. There are bindings and/or implementations in many languages.

[0]: https://godoc.org/golang.org/x/crypto/nacl

Re: Keybase launches encrypted Git

#128

Post by aeorgnoieang »

WorldMaker wrote: post #71
malgorithms wrote: post #2

Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. Meaning if someone compromises your hosted origin, they can quietly compromise your history. So even the fears about data leaks aside, this is a big win for safety. From an entrepreneurial perspective, this is my favorite thing we've done at Keybase. It pushes all the buttons: (1) it's relatively simple,…

How likely/easy would it be to add "know nothing" mirrors of these encrypted repositories? Say that I trust the keybase app (or something that speaks its protocols) possibly indefinitely, but maybe I'm not keen on a single cloud storage backend and want additional secure backup options. (Maybe I'm even unconvinced about the long term guarantee of keybase's storage space offerings due to possibly changing cost/busines…

You can do this with a Git helper like this one:

- [spwhitton/git-remote-gcrypt: PGP-encrypted git remotes](https://github.com/spwhitton/git-remote-gcrypt)

I use [Pass](https://www.passwordstore.org/), a password manager, which uses GPG and Git, and I keep an encrypted copy of my Pass Git repo in Dropbox and have that repo copy setup as a remote in all of the local copies of my password repo. So, the contents of the local repos are encrypted, but in the encrypted copy all of the Git data is encrypted too.

Re: Keybase launches encrypted Git

#129

Post by philip1209 »

Some hypothetical questions:

- How could CI/CD be set up? (Is read-only access possible to the repo? Would Keybase work on a Jenkins box? Could a deploy server verify signatures before deploying?)

- Could one set up mirroring to GitHub? How would this work? (I could see the signing without encryption as a value-add)

- What happens in the event of a force push? Could certain users destroy history?

- Could protected branches eventually be added, eg only certain users can push to master?

Re: Keybase launches encrypted Git

#130

Post by jcahill »

r0ze-at-hn wrote: post #70
1123581321 wrote: post #63

Earlier quoted context omitted.

I think Keybase is more like what Joel Spolsky describes as a "horizontal company" that's appropriate to try to build after already having made money. https://www.joelonsoftware.com/2012/01/06/how-trello-is-diff...

From Joel's article: > That means that our highest priority is removing any obstacles to adoption. Anything that people might use as a reason not to use Trello has to be found and eliminated. In this case I am weary of using something like this that is free because I have seen so many things in the past that were free only to shutdown rapidly after they grew in size, but with no way to pay for themselves and had to p…

Fortunately, Trello's free plan limits are so low that very little of substance will be lost.
Post reply on HN