7 ms·

> PGP is bad and needs to go away how should we sign git commits?

the_pwner224 6y ago
There's nothing special about PGP that makes it good for signing git commits, and plenty of alternatives exist. Signify is a simple tool to do signing, used by OpenBSD: https://news.ycombinator.com/item?id=9708120 https://news.ycombinator.com/item?id=9708120. Minisign is also an alternative, though it doesn't seem as popular: https://jedisct1.github.io/minisign/ https://jedisct1.github.io/minisign/. These may not be well integrated into git, but aside from 'everyone already uses and integrates with PGP,' there's no real reason stopping the usage of these other tools. The two things that PGP does are pretty simple/straighforward. What makes PGP bad is that PGP itself it is really complicated, and the way it is integrated into email etc. is also complicated and carries a lot of historical baggage. But if you just want to make a public/private keypair and then use it to sign & encrypt data, that's pretty easy (or as easy as writing any crypto code can get). Signify, Minisign, and Age are clean, simple implementations. Age does encryption: https://news.ycombinator.com/item?id=21895671 https://news.ycombinator.com/item?id=21895671 Of course this is sort of a https://xkcd.com/927/ https://xkcd.com/927/ situation. PGP is already used by everyone so why switch?
- tptacek 6y ago
  Minisign is designed to be compatible with signify.
- jacques_chester 6y ago
  It's possible to sign with TLS certs, just not well-known. https://stackoverflow.com/questions/50150318/sign-git-commit-with-x509-certificate-in-corporate-environment https://stackoverflow.com/questions/50150318/sign-git-commit...
- monoideism 6y ago
  The perfect is the enemy of the good. -- Voltaire OK, if you're going to downvote this, please tell me how you plan to convince git and Github to replace PGP with signify? Github in particular has invested significant time building up their PGP support. Personally, I would be fine with signify, I've used it in the past and I like it, and I think people are right when they say we should move toward more focused, Unix-style cryptographic tools - for greenfield projects. But that doesn't we should abandon all current uses of PGP, particularly when it's working as well as it is with git and Github. There's absolutely nothing wrong with it. It does what it's supposed to. It took a long time to get PGP supported by Github, and now you're going to want them to change it? Edit: If people want to add support to Git for signify, and lobby Github to support it, I'd be in favor. But strongly, strongly opposed to removing PGP support.
  - wglb 6y ago
    You might want to check out a couple blog posts https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma... And don't complain about downvoting.
    - deleted 6y ago
      [deleted]
    - monoideism 6y ago
      I'm fine if you think I'm an idiot (I definitely can be), if you disagree with my stand on PGP, or my remark about downvoting. I'm often even willing to edit/change/correct my comments. But don't order me around. I'm not your employee, kid, or whoever it is you feel you have a right to speak to like that.

There's nothing special about PGP that makes it good for signing git commits, and plenty of alternatives exist. Signify is a simple tool to do signing, used by OpenBSD: https://news.ycombinator.com/item?id=9708120 https://news.ycombinator.com/item?id=9708120. Minisign is also an alternative, though it doesn't seem as popular: https://jedisct1.github.io/minisign/ https://jedisct1.github.io/minisign/. These may not be well integrated into git, but aside from 'everyone already uses and integrates with PGP,' there's no real reason stopping the usage of these other tools. The two things that PGP does are pretty simple/straighforward. What makes PGP bad is that PGP itself it is really complicated, and the way it is integrated into email etc. is also complicated and carries a lot of historical baggage. But if you just want to make a public/private keypair and then use it to sign & encrypt data, that's pretty easy (or as easy as writing any crypto code can get). Signify, Minisign, and Age are clean, simple implementations. Age does encryption: https://news.ycombinator.com/item?id=21895671 https://news.ycombinator.com/item?id=21895671 Of course this is sort of a https://xkcd.com/927/ https://xkcd.com/927/ situation. PGP is already used by everyone so why switch?

tptacek 6y ago
Minisign is designed to be compatible with signify.
jacques_chester 6y ago
It's possible to sign with TLS certs, just not well-known. https://stackoverflow.com/questions/50150318/sign-git-commit-with-x509-certificate-in-corporate-environment https://stackoverflow.com/questions/50150318/sign-git-commit...
monoideism 6y ago
The perfect is the enemy of the good. -- Voltaire OK, if you're going to downvote this, please tell me how you plan to convince git and Github to replace PGP with signify? Github in particular has invested significant time building up their PGP support. Personally, I would be fine with signify, I've used it in the past and I like it, and I think people are right when they say we should move toward more focused, Unix-style cryptographic tools - for greenfield projects. But that doesn't we should abandon all current uses of PGP, particularly when it's working as well as it is with git and Github. There's absolutely nothing wrong with it. It does what it's supposed to. It took a long time to get PGP supported by Github, and now you're going to want them to change it? Edit: If people want to add support to Git for signify, and lobby Github to support it, I'd be in favor. But strongly, strongly opposed to removing PGP support.
- wglb 6y ago
  You might want to check out a couple blog posts https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma... And don't complain about downvoting.
  - deleted 6y ago
    [deleted]
  - monoideism 6y ago
    I'm fine if you think I'm an idiot (I definitely can be), if you disagree with my stand on PGP, or my remark about downvoting. I'm often even willing to edit/change/correct my comments. But don't order me around. I'm not your employee, kid, or whoever it is you feel you have a right to speak to like that.