3 ms·

I was amused, after discovering Monotone through the I2P project that you can sign your commits in git too (although in a SCM not written in C++, look around fo

by 616c 11y ago

I was amused, after discovering Monotone through the I2P project that you can sign your commits in git too (although in a SCM not written in C++, look around for that famous Linus rant). I was well on board with the idea, like signing my many emails, but even as a rank amateur I have nightmares of waking up like this guy. https://mikegerwitz.com/papers/git-horror-story https://mikegerwitz.com/papers/git-horror-story So I would love tarballs and other things signed, and I do not want to be one of those whiny moochers, but imagine the backlash you get as thankless free software developer when you bork your tag sign or mess up one commit and people through you under the bus, because you cryptographically agreed to it? Haha.

ikeboy 11y ago
Ironically, that gives a "untrusted certificate" error on my phone.
- ryan-c 11y ago
  The cert is valid, but the server is misconfigured (not sending the cert chain).
joeyh 11y ago
If you're reading that as an argument against signing git commits, I suggest you re-read it.
- 616c 11y ago
  I mean, my comment was partially in jest. I check gpg.asc probably more than the average, but not as much as a well-respected Debian maintainer. :-) By the way, I am increasingly interested in trying to wrestle my VMs and various boxes into order. I am tired of failing to learn different DSLs for automation and love the pure Haskell of propellor, which is your tool for managing Debian boxes. http://git.joeyh.name/propellor.git http://git.joeyh.name/propellor.git Part of its cleanliness a la Haskell (which I doubt I can ever learn, but applying it to a task like this makes it seem tangible), is you have signed configs and you encrypt your own config into the repo (with cute patches removing this folder will get my ire comments in the docs). It is very refreshing and honest, like your other software. Hats off to you, sir.

by 616c 11y ago

ikeboy 11y ago

Ironically, that gives a "untrusted certificate" error on my phone.

ryan-c 11y ago
The cert is valid, but the server is misconfigured (not sending the cert chain).

joeyh 11y ago

If you're reading that as an argument against signing git commits, I suggest you re-read it.

616c 11y ago
I mean, my comment was partially in jest. I check gpg.asc probably more than the average, but not as much as a well-respected Debian maintainer. :-) By the way, I am increasingly interested in trying to wrestle my VMs and various boxes into order. I am tired of failing to learn different DSLs for automation and love the pure Haskell of propellor, which is your tool for managing Debian boxes. http://git.joeyh.name/propellor.git http://git.joeyh.name/propellor.git Part of its cleanliness a la Haskell (which I doubt I can ever learn, but applying it to a task like this makes it seem tangible), is you have signed configs and you encrypt your own config into the repo (with cute patches removing this folder will get my ire comments in the docs). It is very refreshing and honest, like your other software. Hats off to you, sir.