News for hackers. Stuff that matters.

A comment on SSH commit verification now supported. Parent comment

Re:SSH commit verification now supported by sodality2 on Tuesday August 23, 2022 @03:23PM (#32570035)
With the digital footprint these days, that might impede employment in the future in certain industries or sectors, especially if it’s tied to your name.
[ Parent | on HN ]
Re:SSH commit verification now supported by ducktective on Tuesday August 23, 2022 @03:32PM (#32570173)
>if it’s tied to your name

How can this be proved? Even with signing, anyone can impersonate anyone.

[ Parent | on HN ]
Re:SSH commit verification now supported by Volundr on Tuesday August 23, 2022 @05:41PM (#32571943)
The entire point of the signature is that it can't be forged. If a commit is signed with your private keys, I can reasonably conclude you authored it.
[ Parent | on HN ]
Re:SSH commit verification now supported by heartbreak on Tuesday August 23, 2022 @05:51PM (#32572038)
I know this is a solved problem in certain contexts, but realistically how does a third party prove that your private keys are yours?
[ Parent | on HN ]
Re:SSH commit verification now supported by dinkledunk on Tuesday August 23, 2022 @06:07PM (#32572228)
Because if you're signing your commits you're probably also the type of person to sign your email with the same key.
[ Parent | on HN ]
Re:SSH commit verification now supported by palata on Tuesday August 23, 2022 @08:20PM (#32573433)
Adding a data point to your statistics: I sign commits and packages I maintain (when it applies), not my emails.
[ Parent | on HN ]