Re:SSH commit verification now supported
by sodality2 on Tuesday August 23, 2022 @03:14PM
(#32569841)
Say you’re writing some code that may be illegal (piracy stream, rips off another API with licensed content, etc). I would want to deny that it was me (but then, i wouldn’t connect it to my real-life identity at all).
[ Parent
| on HN ]
Re:SSH commit verification now supported
by ducktective on Tuesday August 23, 2022 @03:19PM
(#32569958)
It's that serious? Wouldn't the offended party just ask for the content/service/repo be removed?
Re:SSH commit verification now supported
by sodality2 on Tuesday August 23, 2022 @03:23PM
(#32570035)
With the digital footprint these days, that might impede employment in the future in certain industries or sectors, especially if it’s tied to your name.
Re:SSH commit verification now supported
by ducktective on Tuesday August 23, 2022 @03:32PM
(#32570173)
>if it’s tied to your name
How can this be proved? Even with signing, anyone can impersonate anyone.
The entire point of the signature is that it can't be forged. If a commit is signed with your private keys, I can reasonably conclude you authored it.
Re:SSH commit verification now supported
by heartbreak on Tuesday August 23, 2022 @05:51PM
(#32572038)
I know this is a solved problem in certain contexts, but realistically how does a third party prove that your private keys are yours?
Re:SSH commit verification now supported
by dinkledunk on Tuesday August 23, 2022 @06:07PM
(#32572228)
Because if you're signing your commits you're probably also the type of person to sign your email with the same key.
Adding a data point to your statistics: I sign commits and packages I maintain (when it applies), not my emails.
Obvious recent case is Tornado Cash.