3 ms·
Commit signatures do nothing to verify that his device wasn't hacked, it just verifies that someone got access to his key. Geeze this is just stupidity all the
by tacos 10y ago
Commit signatures do nothing to verify that his device wasn't hacked, it just verifies that someone got access to his key. Geeze this is just stupidity all the way down.
- bluejekyll 10y agoIn addition to having the access keys to github, it also requires access to the secret in the pgp key which gives you identity proof. Ideally that's password protected too. It's defense in depth.
- tacos 10y agoThat password is potentially ten lines down in the keylogger report. Depth isn't as deep as you think.