4 ms·

Note that you don't need keybase.io to sign your commits: https://help.github.com/articles/signing-commits-using-gpg/ https://help.github.com/articles/signing-c

Note that you don't need keybase.io to sign your commits: https://help.github.com/articles/signing-commits-using-gpg/ https://help.github.com/articles/signing-commits-using-gpg/

lil1729 10y ago
Thanks for saying this. Or in other words, there are two steps: 1. Make git aware of your signing key git config user.signingkey "..." 2. Sign the commit git commit -S ... That's it.
- akerro 10y ago
  You can also configure git in global config or per-repo to sign commit automatically: https://harryrschwartz.com/2014/11/01/automatically-signing-your-git-commits.html https://harryrschwartz.com/2014/11/01/automatically-signing-...
ex_amazon_sde 10y ago
...with the added security benefit of not uploading your private key on Keybase!
- beardog 10y ago
  How is publicly sharing your public key a security flaw?
  - dijit 10y ago
    Keybase would prefer to handle your private key too. You can work with your key offline too, but you have to be aware that this is what you want when setting up- and it's very much not the happy path, so the site will not fully work as you might expect. Not faulting them, they provide the steps needed, but it might be annoying enough for some people to start uploading private keys.
    - tribaal 10y ago
      I've signed up a long time ago (yay early adopters I guess), so I can't comment on the sign up process or setup with your own GPG key nowdays. But their website works 100% and provides all the functionality if you don't let them host the private key (they give you an easy-to-inspect snippet to paste into your terminal that downloads/signs/uploads things for them. Note, it does do anything when you paste - you need to manually hit enter) Not disagreeing with you - Just adding my 2c.
      - technomancy 10y ago
        It works fine; you just have to know up front to not just click "yes" for everything during the sign-up process. Not a big deal for people who already know how GPG works, but the whole point of Keybase is to make it easier to use for people new to crypto, and that audience can't be expected to understand that the default settings are a terrible idea.
  - ex_amazon_sde 10y ago
    I'm talking about uploading your private key. Obviously, it's required if you want keybase to sign on your behalf.
- OJFord 10y ago
  You can use Keybase with GPG without letting it handle your private key. (I do.)
  - deleted 10y ago
    [deleted]
  - rietta 10y ago
    Same for me.
  - pigeons 10y ago
    You can but last time I used it the first option you were presented with was giving keybase your key. I don't know if that's changed years later because I closed the app at that point, I wasn't interested in using or encouraging others to use such a thing. The guy pointing this out was downvoted and I frequently see the fact that its possible to not give them your key presented as somehow making it acceptable that they ask for it.
- rietta 10y ago
  Which I have opted not to do as a over a decade user of GnuPG. But for complete newbs, JavaScript managed keys is preferable to no key at all.
csubj 10y ago
Much easier than keybase.io. It's still early for keybase though, Im excited to see where they go with it.
ajacksified 10y ago
I wrote up my own guide a few months ago, when setting up commit signing[0] - keybase optional but encouraged as a nice tool to use. [0] https://thejacklawson.com/2016/05/gpg/index.html https://thejacklawson.com/2016/05/gpg/index.html

Note that you don't need keybase.io to sign your commits: https://help.github.com/articles/signing-commits-using-gpg/ https://help.github.com/articles/signing-commits-using-gpg/

lil1729 10y ago

Thanks for saying this. Or in other words, there are two steps: 1. Make git aware of your signing key git config user.signingkey "..." 2. Sign the commit git commit -S ... That's it.

akerro 10y ago
You can also configure git in global config or per-repo to sign commit automatically: https://harryrschwartz.com/2014/11/01/automatically-signing-your-git-commits.html https://harryrschwartz.com/2014/11/01/automatically-signing-...

ex_amazon_sde 10y ago

...with the added security benefit of not uploading your private key on Keybase!

beardog 10y ago
How is publicly sharing your public key a security flaw?
- dijit 10y ago
  Keybase would prefer to handle your private key too. You can work with your key offline too, but you have to be aware that this is what you want when setting up- and it's very much not the happy path, so the site will not fully work as you might expect. Not faulting them, they provide the steps needed, but it might be annoying enough for some people to start uploading private keys.
  - tribaal 10y ago
    I've signed up a long time ago (yay early adopters I guess), so I can't comment on the sign up process or setup with your own GPG key nowdays. But their website works 100% and provides all the functionality if you don't let them host the private key (they give you an easy-to-inspect snippet to paste into your terminal that downloads/signs/uploads things for them. Note, it does do anything when you paste - you need to manually hit enter) Not disagreeing with you - Just adding my 2c.
    - technomancy 10y ago
      It works fine; you just have to know up front to not just click "yes" for everything during the sign-up process. Not a big deal for people who already know how GPG works, but the whole point of Keybase is to make it easier to use for people new to crypto, and that audience can't be expected to understand that the default settings are a terrible idea.
- ex_amazon_sde 10y ago
  I'm talking about uploading your private key. Obviously, it's required if you want keybase to sign on your behalf.
OJFord 10y ago
You can use Keybase with GPG without letting it handle your private key. (I do.)
- deleted 10y ago
  [deleted]
- rietta 10y ago
  Same for me.
- pigeons 10y ago
  You can but last time I used it the first option you were presented with was giving keybase your key. I don't know if that's changed years later because I closed the app at that point, I wasn't interested in using or encouraging others to use such a thing. The guy pointing this out was downvoted and I frequently see the fact that its possible to not give them your key presented as somehow making it acceptable that they ask for it.
rietta 10y ago
Which I have opted not to do as a over a decade user of GnuPG. But for complete newbs, JavaScript managed keys is preferable to no key at all.

csubj 10y ago

Much easier than keybase.io. It's still early for keybase though, Im excited to see where they go with it.

ajacksified 10y ago

I wrote up my own guide a few months ago, when setting up commit signing[0] - keybase optional but encouraged as a nice tool to use. [0] https://thejacklawson.com/2016/05/gpg/index.html https://thejacklawson.com/2016/05/gpg/index.html