Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I configure my Git identities

benji.dog

Post reply on HN
Print view View original

81–90 of 113 posts

Re: How I configure my Git identities

#81

Post by tecleandor »

kevindamm wrote: post #56
spacemanspiff01 wrote: post #51

Earlier quoted context omitted.

Did he use the same signing key? (If we are being generous)

I don't think you can -- the key's identity needs to match the name/comment/email it was generated with. You would have to regenerate after every name change to have them all verified (and keep them all in file with the got server afterwards, too).

I'd say that in general it verifies it with the email, but it depends.

I just did a test with four commits with a signature matching both on user and email, only on email, only on user, and in none of them and:

From GitHub, it validates signatures with the email registered in the commit: If the signature matches the key registered for the GitHub user with that email address, it says "Verified" in a green box. If it doesn't , it says "Unverified" in a yellow box.

So GitHub "Verified" two commits: the one that matches all the fields and the one that only matches the email.

From git CLI, it depends on your configuration.

If you do a `git log --show-signature` at first it will complain with `error: gpg.ssh.allowedSignersFile needs to be configured and exist for ssh signature verification`. You need to set up a file with your trusted ssh signatures.

Once you set that up, it will verify ALL correctly signed commits, even if they don't match the commit email address. Seems like the signature and the commit can have different emails, so to speak: "commited by fake@email.com and signed by real@email.com. The signature is valid by real@email.com".

Example I did, changing the email addresses:

  git show --show-signature 11906e1
  commit 11906e14155ae08b7e7e23f26aa9c04913ade5dd
  Good "git" signature for good@email.com with ED25519 key SHA256:9uU6+7pNNzwVEKTecpJE4Bmm2WXaqZXMZRLe9rJZ0ZY
  Author: fake name 
  Date:   Mon Nov 25 13:36:28 2024 +0100

Re: How I configure my Git identities

#82

Post by sshine »

necovek wrote: post #70
Sardtok wrote: post #65

Earlier quoted context omitted.

Mixing personal and work data in the same directories on disk can be an issue. Requires extra work to cleanly separate private stuff and confidential work stuff.

This is still very general, and in opposition to the previous advice. A solution to this seems to be "use separate directories", not "use separate machines".

Using separate directories does not guarantee proper deletion.

Re: How I configure my Git identities

#83

Post by necovek »

lijok wrote: post #75
necovek wrote: post #73

Earlier quoted context omitted.

If it's a personal laptop, I would assume there is no "endpoint monitoring software" installed. When it comes to "assets", companies make a big fuss about leaking them, but in reality, it's totally irrelevant. I.e. witness Windows OS source code being leaked: Microsoft wasn't affected at all. Leaking short/mid-term plans would probably have a bigger effect (abuse on the stock market, beating a competitor to the marke…

> When it comes to "assets", companies make a big fuss about leaking them, but in reality, it's totally irrelevant There’s no milder way to put this; you’re delusional.

There are certainly "milder ways" to put it, but the tone one uses is certainly on the author.

For example, please let me know of any one's company leaked source code and how someone has used that to their advantage and become amazingly successful in the same market?

Re: How I configure my Git identities

#84

Post by necovek »

sshine wrote: post #82
necovek wrote: post #70

Earlier quoted context omitted.

This is still very general, and in opposition to the previous advice. A solution to this seems to be "use separate directories", not "use separate machines".

Using separate directories does not guarantee proper deletion.

Using separate laptops does not guarantee proper deletion. Not sure what your point is?

(Contractual terms between an employee/contractor and employer/company is what ensures there is no abuse for the most part)

Re: How I configure my Git identities

#85

Post by sshine »

necovek wrote: post #84
sshine wrote: post #82

Earlier quoted context omitted.

Using separate directories does not guarantee proper deletion.

Using separate laptops does not guarantee proper deletion. Not sure what your point is? (Contractual terms between an employee/contractor and employer/company is what ensures there is no abuse for the most part)

I should say:

Using separate directories makes improper deletion likely.

Using separate computers with full-disk encryption and shredding procedures makes proper deletion a happy path.

It's not that you cannot properly isolate environments on a single computer.

It's that a single computer is, unless you're a Qubes/BSD/Hypervisor fanatic, not very isolated at all.

So if/when your personal computer gets compromised because of a browser zero-day, your work's intellectual property is potentially compromised.

When you combine that with likely not deleting files properly (or at all), the window of opportunity for IP theft is much bigger.

When you further add the complete unlikeliness that former employees/contractors will report that their personal computers were compromised after having neglected to properly purge your intellectual property, the case for buying your employees/contractors dedicated machinery becomes a no-brainer. Simply from a corporate risk perspective.

It's not a practical problem, but a principal + legal problem.

Re: How I configure my Git identities

#86

Post by necovek »

sshine wrote: post #79
necovek wrote: post #60

Earlier quoted context omitted.

Using a "personal machine for work" is a very wide gamut of situations (eg. at one remote-first company, we were expected to provide our own laptops, and got extra money every 2-3 years to buy a new one, but they were always our "personal" laptops even if the company contributed to paying them off; or what if you are a temporary contractor; or...). Care to elaborate in what circumstances is it a problem and why? Edit…

> Care to elaborate in what circumstances is using a "personal machine for work" a problem and why? When you stop working for an employer/customer and you are legally required to purge all files. Having everything work-related on a dedicated machine makes purging all files very easy. Not having everything work-related on a dedicated machine makes purging all files questionable.

Ok, so one circumstance is when there is a "legal requirement to purge all files". That's certainly not "always" and not always as hard: one of my jobs was at an open source company, and there are plenty of those to go around these days; as a consultant, you may start with some base work to build off of that you keep the rights to as well...

This also assumes you never-ever used a personal device to access any of them either (they might be in caches or Trash/Recycle Bin) — and I agree that to satisfy such a legal requirement, you probably don't want to be using a personal device to access them at all.

Keeping things separate has some upsides, but also some downsides (multiple devices to lug around) — depending on their situation, everybody should choose their own compromise (granted, some engagement contracts will make that choice for you).

Re: How I configure my Git identities

#87

Post by lijok »

necovek wrote: post #83
lijok wrote: post #75

Earlier quoted context omitted.

> When it comes to "assets", companies make a big fuss about leaking them, but in reality, it's totally irrelevant There’s no milder way to put this; you’re delusional.

There are certainly "milder ways" to put it, but the tone one uses is certainly on the author. For example, please let me know of any one's company leaked source code and how someone has used that to their advantage and become amazingly successful in the same market?

What does this have to do with work device management? Are you seriously suggesting using a personal device for work, despite the asset leakage risk, and relying on "it doesn't matter" as recourse if that risk were to materialize?

Re: How I configure my Git identities

#88

Post by sshine »

necovek wrote: post #86
sshine wrote: post #79

Earlier quoted context omitted.

> Care to elaborate in what circumstances is using a "personal machine for work" a problem and why? When you stop working for an employer/customer and you are legally required to purge all files. Having everything work-related on a dedicated machine makes purging all files very easy. Not having everything work-related on a dedicated machine makes purging all files questionable.

Ok, so one circumstance is when there is a "legal requirement to purge all files". That's certainly not "always" and not always as hard: one of my jobs was at an open source company, and there are plenty of those to go around these days; as a consultant, you may start with some base work to build off of that you keep the rights to as well... This also assumes you never-ever used a personal device to access any of the…

I've personally come to be very happy with hardware isolation as a method of mental compartmentalization.

E.g. choice of computer dictates choice of activity, I won't accidentally work on something when I'm not supposed to.

I've had paid-for open source gigs, and I have a bunch of open source work spread out on a bunch of machines.

Downsides are:

  - The bag gets heavy when I have multiple events for separate customers/events on the same day
  - For stuff that is shared between computers (e.g. open source projects), I can forget to git push
I've tried to put my machines on the same VPN for some convenience wrt. file sync.

Fortunately, the most locked off machines never need for other computers to connect to them.

And yes, this came as a customer requirement, but I've decided to grow with the choice.

I don't trust process isolation on a single computer very much.

Re: How I configure my Git identities

#89

Post by theamk »

helloooooooo wrote: post #69
Ferret7446 wrote: post #64

Earlier quoted context omitted.

You should trust it as much as you trust any document written/signed by your employees. Which is to say, if you can't trust your employees to not properly identify their commits, you should fire them.

No, the previous commenter is saying that you cannot trust the identity provided in commits period. This has nothing to do with trusting employees, rather placing trust in the identity in commit.

This is true in general internet, but workplaces are normally more high-trust. If one needs to guard themselves against hacking by their co-worker, they have less time and energy to do actual work.

So a fiction character is maaybe OK, as long as it is clearly fictional name and no one else in the company does that; but other stuff, like actually impersonating other co-workers would be very bad, and should eventually leave to firing.

Re: How I configure my Git identities

#90

Post by necovek »

sshine wrote: post #85
necovek wrote: post #84

Earlier quoted context omitted.

Using separate laptops does not guarantee proper deletion. Not sure what your point is? (Contractual terms between an employee/contractor and employer/company is what ensures there is no abuse for the most part)

I should say: Using separate directories makes improper deletion likely. Using separate computers with full-disk encryption and shredding procedures makes proper deletion a happy path. It's not that you cannot properly isolate environments on a single computer. It's that a single computer is, unless you're a Qubes/BSD/Hypervisor fanatic, not very isolated at all. So if/when your personal computer gets compromised bec…

I fully agree it's a legal problem, which is what my point was from the beginning — depending on the circumstances, it might apply to you or not.

Companies both have to have a set of "processes" in place for legal/compliance reasons, and an employee is liable if they do something that's outside the recommended practice (like using a personal device when forbidden by such policies).

Still, the focus should be on liability and ensuring compliance with legal terms, and an employee needs to make sure they do that. In some cases, that's easier done with a separate computer. In others (when there is no direct spelled-out requirement), downsides of using a separate device outweight the benefits of making compliance with legal terms easier.

As a side note, a browser zero-day is probably even more likely to target work computers, so that example is pretty bad — company data remaining on personal devices by accident is where the problem really is.

Post reply on HN