News for hackers. Stuff that matters.

A comment on Sign arbitrary data with your SSH keys. Parent comment

Re:Sign arbitrary data with your SSH keys by erk__ on Saturday November 13, 2021 @05:15AM (#29208790)
And similarly GPG keys are at github.com/username.gpg
[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by giaour on Saturday November 13, 2021 @09:24AM (#29209931)
This seems more legit. If a user is signing their commits, other users should have access to their public keys in order to verify the signatures.
[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by megous on Saturday November 13, 2021 @02:04PM (#29212331)
Usefulness of that access from the same service you're getting the signed commit from is close to nil.

Public keys should be distributed in a trustworthy way.

[ Parent | on HN ]