Re:Signing Git commits with your SSH key (2021)
by pointlessone on Wednesday September 14, 2022 @02:17AM
(#32833852)
You don't have to reuse your keys. You can have a separate key(s) for signing.
[ Parent
| on HN ]
Re:Signing Git commits with your SSH key (2021)
by hvdijk on Wednesday September 14, 2022 @04:45AM
(#32834662)
The only reason the article gives for using this over using the signing with GPG keys is that you will have an SSH key already. If you need to create a new key, are there any reasons for going for an SSH key over a GPG key?
Re:Signing Git commits with your SSH key (2021)
by conaclos on Wednesday September 14, 2022 @05:19AM
(#32834863)
Because you are already acustomed to ssh?
I personaly use GPG. However, GPG looks complex and the ergonomics of GnuPG cli is horrible.
Re:Signing Git commits with your SSH key (2021)
by megous on Wednesday September 14, 2022 @05:56AM
(#32835077)
So use some GUI?
CLI ergonomic around working with ssh keys and ssh certificates is not great either.
And GPG/PGP at least has some standards around key distribution, web of trust, subkeys, etc.
Re:Signing Git commits with your SSH key (2021)
by donatj on Wednesday September 14, 2022 @06:13AM
(#32835168)
I use GPG Suite on Mac and even then the ergonomics are confusing. GPG/PGP is just kind of confusing for us not deeply into cryptography.
Re:Signing Git commits with your SSH key (2021)
by megous on Wednesday September 14, 2022 @07:40AM
(#32835780)
I looked up the screenshots. The app looks like the most trivial possible UI for basic public key cryptography. Just a basic list of your/other people's keys (pretty much a contact list) and some ways to acquire them.
SSH keys if used in place of GPG would have almost the same UI. It's not the problem of GPG, but of the underlying concepts.
You don't need to be deep into cryptography, just understand some basic concepts from the wikipedia article, or whatnot.
Re:Signing Git commits with your SSH key (2021)
by michaelt on Wednesday September 14, 2022 @06:23AM
(#32835242)
The real reason is: I don't gain any security from signing my own commits, I gain security when other people sign their commits which they are currently not doing.
Therefore, making things easier to set up makes a greater contribution to security than strict, gold-standard security features that nobody adopts.