Live data from Hacker News

Setup Keybase.io, GPG and Git to sign commits on GitHub

github.com

31–40 of 121 posts

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#31
post #23

Earlier quoted context omitted.

...with the added security benefit of not uploading your private key on Keybase!

How is publicly sharing your public key a security flaw?

I'm talking about uploading your private key. Obviously, it's required if you want keybase to sign on your behalf.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#33

You don't need to have home brew. And most of this can be done a lot simpler: https://gist.github.com/danieleggert/b029d44d4a54b328c0bac65...

The Homebrew steps seem simpler to me, especially if you already use it. Also easy to update - does the suite auto-update?

Why don't you like Homebrew?

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#34
post #2

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

Yes. Keybase is trying to make a walled garden for itself.

I got really frustrated by this a couple weeks ago when I needed to get a key from a contractor but it was only on Keybase, which at the time I thought could be used as a GPG keyserver.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#35
But what do you do with the signatures on the signed commits? It is of some, limited value, to GPG sign because it does provide a little bit more of "John Hancock" for a release, but how does this work in a continuous integration environment? Does the CI server reject commits that are not properly signed? Does the server refuse to run unsigned or incorrectly signed Git deployed code?

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#37
post #3
post #2

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

AFAIK keybase.io is not meant as a key exchange server. You should publish your keys using an existing exchange server.

The problem is that AFAIK they don't tell their users that anywhere, and I often encounter people that only have their key on Keybase and it's a real pain to import their key.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#38
post #6

Note that you don't need keybase.io to sign your commits: https://help.github.com/articles/signing-commits-using-gpg/

...with the added security benefit of not uploading your private key on Keybase!

Which I have opted not to do as a over a decade user of GnuPG. But for complete newbs, JavaScript managed keys is preferable to no key at all.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#40
post #3

Earlier quoted context omitted.

AFAIK keybase.io is not meant as a key exchange server. You should publish your keys using an existing exchange server.

The problem is that AFAIK they don't tell their users that anywhere, and I often encounter people that only have their key on Keybase and it's a real pain to import their key.

How much of a pain is it? You just click on the fingerprint on their page, no?

https://keybase.io/stavros

Post reply on HN