News for hackers. Stuff that matters.

A comment on Sign arbitrary data with your SSH keys. Parent comment

Re:Sign arbitrary data with your SSH keys by giaour on Saturday November 13, 2021 @09:24AM (#29209931)
This seems more legit. If a user is signing their commits, other users should have access to their public keys in order to verify the signatures.
[ Parent | on HN ]
Re:Sign arbitrary data with your SSH keys by megous on Saturday November 13, 2021 @02:04PM (#29212331)
Usefulness of that access from the same service you're getting the signed commit from is close to nil.

Public keys should be distributed in a trustworthy way.

[ Parent | on HN ]