News for hackers. Stuff that matters.
Re:Setup Keybase.io, GPG and Git to sign commits on GitHub by beardog on Monday August 15, 2016 @08:46AM (#12290037)
How is publicly sharing your public key a security flaw?
Re:Setup Keybase.io, GPG and Git to sign commits on GitHub by dijit on Monday August 15, 2016 @08:54AM (#12290074)
Keybase would prefer to handle your private key too. You can work with your key offline too, but you have to be aware that this is what you want when setting up- and it's very much not the happy path, so the site will not fully work as you might expect.

Not faulting them, they provide the steps needed, but it might be annoying enough for some people to start uploading private keys.

Re:Setup Keybase.io, GPG and Git to sign commits on GitHub by tribaal on Monday August 15, 2016 @08:59AM (#12290098)
I've signed up a long time ago (yay early adopters I guess), so I can't comment on the sign up process or setup with your own GPG key nowdays.

But their website works 100% and provides all the functionality if you don't let them host the private key (they give you an easy-to-inspect snippet to paste into your terminal that downloads/signs/uploads things for them. Note, it does do anything when you paste - you need to manually hit enter)

Not disagreeing with you - Just adding my 2c.

Re:Setup Keybase.io, GPG and Git to sign commits on GitHub by technomancy on Monday August 15, 2016 @09:05PM (#12294792)
It works fine; you just have to know up front to not just click "yes" for everything during the sign-up process. Not a big deal for people who already know how GPG works, but the whole point of Keybase is to make it easier to use for people new to crypto, and that audience can't be expected to understand that the default settings are a terrible idea.
Re:Setup Keybase.io, GPG and Git to sign commits on GitHub by ex_amazon_sde on Monday August 15, 2016 @09:16AM (#12290183)
I'm talking about uploading your private key. Obviously, it's required if you want keybase to sign on your behalf.