5 ms·

How so?

epistasis 11y ago
Once you strip away the insults, what's left appears to be: 1) It's unclear what we should sign on a commit, therefore we shouldn't. I'm not sure what to make of that. 2) Since a key may be revoked, any signatures should not go into the commit. Presumably Torvalds thinks that tags should be deletable, but commits should not, or something. 3) That if all commits are signed, then it become automated, and therefore somehow not worthwhile. Meanwhile, automated signing seems awesome because we know that at least the signer had possession of the key. I can't really extract much more logic out of that post, and none of it sways me in the slightest.
- pdkl95 11y ago
  While I think that Linus is relying too much on SHA1[1], he makes several good points. His primary concern is the difference between adding signed content as part of the commit vs using "git tag -s"[2] which also signs the commit with GPG. The difference is that "git tag -s" includes the DAG metadata so the git history itself is verified. This isn't about using GPG siged vs nothing, it's "GPG signed in the commit" vs "GPG signed commit and metadata". The bit about revoking keys is also interesting. He's pointing out that if you keep the signature in the commit, you have permanently bound that particular signature with the commit data. It's mixing two different types of data into one storage location. The alternative is using tags, which shadow the main branch. This way you have the option of using those tags, or you can create new tags (with new signatures) with a new key. This gives flexibility for the future. > insults I don't see Linus insulting anyone in that post. Explaining the problems with a method is not an insult. > therefore we shouldn't Is that post really that hard to read? I find it obvious that he is saying you should use the builtin signing with "git tag -s". [1] It's worth observing that this is a comment from 2009; I'm curious if he has changed his opinion on SHA1 in over the last 6 years. [2] -s, --sign Make a GPG-signed tag, using the default e-mail address’s key
- vacri 11y ago
  Ah, the curse of being Torvalds. He writes 600 words clearly explaining his position in an educational manner, and near the end, says an action is 'stupid' (not a person!) in one single sentence. This is characterised as "once you strip away the insults". You've just insulted Torvalds more than he insulted the person he was responding to; hardly a position to be moralising from. Fuck that shit.

How so?

Once you strip away the insults, what's left appears to be: 1) It's unclear what we should sign on a commit, therefore we shouldn't. I'm not sure what to make of that. 2) Since a key may be revoked, any signatures should not go into the commit. Presumably Torvalds thinks that tags should be deletable, but commits should not, or something. 3) That if all commits are signed, then it become automated, and therefore somehow not worthwhile. Meanwhile, automated signing seems awesome because we know that at least the signer had possession of the key. I can't really extract much more logic out of that post, and none of it sways me in the slightest.

pdkl95 11y ago
While I think that Linus is relying too much on SHA1[1], he makes several good points. His primary concern is the difference between adding signed content as part of the commit vs using "git tag -s"[2] which also signs the commit with GPG. The difference is that "git tag -s" includes the DAG metadata so the git history itself is verified. This isn't about using GPG siged vs nothing, it's "GPG signed in the commit" vs "GPG signed commit and metadata". The bit about revoking keys is also interesting. He's pointing out that if you keep the signature in the commit, you have permanently bound that particular signature with the commit data. It's mixing two different types of data into one storage location. The alternative is using tags, which shadow the main branch. This way you have the option of using those tags, or you can create new tags (with new signatures) with a new key. This gives flexibility for the future. > insults I don't see Linus insulting anyone in that post. Explaining the problems with a method is not an insult. > therefore we shouldn't Is that post really that hard to read? I find it obvious that he is saying you should use the builtin signing with "git tag -s". [1] It's worth observing that this is a comment from 2009; I'm curious if he has changed his opinion on SHA1 in over the last 6 years. [2] -s, --sign Make a GPG-signed tag, using the default e-mail address’s key
vacri 11y ago
Ah, the curse of being Torvalds. He writes 600 words clearly explaining his position in an educational manner, and near the end, says an action is 'stupid' (not a person!) in one single sentence. This is characterised as "once you strip away the insults". You've just insulted Torvalds more than he insulted the person he was responding to; hardly a position to be moralising from. Fuck that shit.