Hacker News new | past | comments | ask | show | jobs | submit login
I'm not going to cryptographically sign my Git commits, and you shouldn't either (glyph.im)
2 points by azeemba on Jan 27, 2024 | hide | past | favorite | 2 comments



I have to admit I only skimmed a lot of this extremely long winded rant and didn't get to the end, but AFAICT they're claiming the only "benefit" is a "little verified tick" and that one of the cons is accepting responsibility for previous commits.

I don't think either of those is a fair or accurate assessment.

A signed commit tells you exactly one thing: the person who made the commit is who they say they are, according to the signing key used.

That's it. It's essentially a defence against the nature of git where commits are decoupled from centralised authentication, and thus anyone can make a commit with anyone's name on it.

Signing doesn't prevent you making the commit in the name of someone else (unless you reject unsigned commits) but it stands out as being unsigned.


Git is not GitHub. Also, the author should consider going into politics.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: