Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Setup Keybase.io, GPG and Git to sign commits on GitHub

github.com

Post reply on HN
Print view View original

61–70 of 121 posts

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#61

Post by WorldMaker »

akerro wrote: post #43
StavrosK wrote: post #40

Earlier quoted context omitted.

How much of a pain is it? You just click on the fingerprint on their page, no? https://keybase.io/stavros

OK, I clicked. Where is your email address? Was that stawros or stavros? Do I really need to copy the key or .asc address, wget it and import? How do I know if that's your latest key? Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? THERE MUST BE AN EASIER WAY! Ehh screw that. I'll write it in plaintext.

Keybase has a pretty good command line tool and commands very similar to ones in the article we are commenting upon can be used to grab the public key of a Keybase user using just their Keybase username.

It should probably be easy to presume that if a user gives you their Keybase username they are telling you it's the easiest way to get their most up-to-date key(s) and revocations and that they are actively managing it. (Pretty much the same assumption any time anyone ever suggests to you a specific keyserver over just a fingerprint and keyserver roulette; that's probably the keyserver they actively check/update/revoke and will be the timeliest.)

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#65

Post by davexunit »

WorldMaker wrote: post #61
akerro wrote: post #43

Earlier quoted context omitted.

OK, I clicked. Where is your email address? Was that stawros or stavros? Do I really need to copy the key or .asc address, wget it and import? How do I know if that's your latest key? Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? THERE MUST BE AN EASIER WAY! Ehh screw that. I'll write it in plaintext.

Keybase has a pretty good command line tool and commands very similar to ones in the article we are commenting upon can be used to grab the public key of a Keybase user using just their Keybase username. It should probably be easy to presume that if a user gives you their Keybase username they are telling you it's the easiest way to get their most up-to-date key(s) and revocations and that they are actively managing…

>Keybase has a pretty good command line tool

Another example of the walled garden. You need their tool, whereas you can just use gpg with every other keyserver.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#66

Post by electricEmu »

akerro wrote: post #12
ithkuil wrote: post #5

Anybody here got invitation codes for keybase ?

You don't need keybase to sign your commits. Any standard and key-exchange compatible pgp/gpg client will do. By using keybase you're just adding more work for everyone. https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

Keybase makes it really easy to sign commits. By using keybase you get to manage keys and sign quickly. gpg will take hours of reading with its non-intuative cli. You're making less work for yourself.

Gpg is the flossing of encryption. It has great efficacy and terrible efficiency.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#67

Post by WorldMaker »

davexunit wrote: post #65
WorldMaker wrote: post #61

Earlier quoted context omitted.

Keybase has a pretty good command line tool and commands very similar to ones in the article we are commenting upon can be used to grab the public key of a Keybase user using just their Keybase username. It should probably be easy to presume that if a user gives you their Keybase username they are telling you it's the easiest way to get their most up-to-date key(s) and revocations and that they are actively managing…

>Keybase has a pretty good command line tool Another example of the walled garden. You need their tool, whereas you can just use gpg with every other keyserver.

Sure. It would be great if they supported both. The suggestion is to use their tooling because it provides a lot of added value, but yes, it would be great if they also provided a standard "dumb" PGP/GPG keyserver, too.

Maybe consider contributing to the effort?

Quick searched turned up several issues tracking the question:

https://github.com/keybase/keybase-issues/issues/327

https://github.com/keybase/keybase-issues/issues/890

https://github.com/keybase/keybase-issues/issues/1266

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#68

Post by snassar »

WorldMaker wrote: post #53
snassar wrote: post #28

Earlier quoted context omitted.

I don't really get what keybase.io is supposed to solve, but it doesn't get in the way of importing keys into Enigmail. If you are in Enigmail's Keymanager you can import from a URL when the content is well-formatted. Examples that work: https://keybase.io/snassar/key.asc https://pgp.samirnassar.com http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488... It would be nice if Keybase made the URL more easily "g…

«I don't really get what keybase.io is supposed to solve» Keybase was built to solve the "web of trust" bootstrap problem [1] by leveraging the web of social media profiles a user typically has with simple replicable proofs of social media identity. [1] Arguably the hardest problem in PKI: how do you get user to trust that a public key is for the right person? In the classic PGP/GPG web of trust you do things like "k…

Fair enough, when it comes to coming up with creative ways to solve the web of trust problem.

I still do not know what problem keybase.io solves when they allow uploading of private keys.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#70

Post by pyvek »

quchen wrote: post #52

If anyone wants in, here are 5 invite links. [Edit: all used up.] Each works for only one signup, so hurry up :-) By the way, most users get around 20 free invites shortly after signing up. If one of the links above opened your account, why not share five of your own invites afterwards?

Here are some more –

https://keybase.io/inv/cd1e58f4c6

https://keybase.io/inv/561cd3baeb

https://keybase.io/inv/c794a4ca38

https://keybase.io/inv/5201b55fdd

https://keybase.io/inv/f41ca64909

Post reply on HN