3 ms·
GPG is still incredibly useful for me, if only for SSH keys on a YubiKey smart card. I need to get better at code signing on FOSS projects.
by confounded 9y ago
GPG is still incredibly useful for me, if only for SSH keys on a YubiKey smart card. I need to get better at code signing on FOSS projects.
- hdhzy 9y agoPass [0] is also incredibly useful. Also Facebook and many Bitcoin exchanges can PGP encrypt sent emails. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/
- adisbladis 9y agoActually it's very easy if you use git, just 2 lines of config. git config --global user.signingkey <your_pub_here> git config --global commit.gpgsign true
- brians 9y agoThat's not the hard part. The hard part is getting keys moved around, expiry updated, subkeys handled—maybe having one key on the Yubikey helps with this, but I think sublet expiration is still going to be a problem.
- confounded 9y agoYup. By signing releases / commits with a particular key you're committing to maintaining possession and security of the key over the long term. For someone that loses their house key about 3 times a year, this is a big deal!