4 ms·
>It's not a "problem," To me it is a problem and I'm glad they are pointing it out. I suspected this was possible but wasn't sure, now I know for sure.
by EthanHeilman 8y ago
>It's not a "problem,"
To me it is a problem and I'm glad they are pointing it out. I suspected this was possible but wasn't sure, now I know for sure.
- lqet 8y agoTechnically, it is the same "problem" as falsely writing "this proofs P = NP" into the commit message. It's just free text, you can put whatever you want there (as long as the email address is formatted correctly, I guess). Edit: Github actually marks verified commits in their GUI: https://help.github.com/assets/images/help/commits/gpg-signed-commit-verified-without-details.png https://help.github.com/assets/images/help/commits/gpg-signe...
- geofft 8y agoI will admit that GitHub formats the commit in a way where it looks like the commit author may have been verified in some way (because it's linked to a GitHub account, and approximately no other type of online service permits posting things from an account without actually being from that account - the PGP keyservers are the only other one I can think of!), and the content of commit messages don't look like they're endorsed by GitHub. I'm not sure if there's an easy way in the UI to demonstrate unverified/verified, though. Even a small broken-lock icon would imply that something is wrong when it's not really wrong, it's just common practice for this to be entirely based on trust. Perhaps it would help to show the verified identity of the user who pushed the commit to GitHub alongside the unverified author?
- Boulth 8y agoIt reminded me of this interesting behavior of keyservers, that is by design but still surprising - anyone can add UIDs to any key: https://bitbucket.org/skskeyserver/sks-keyserver/issues/41/web-app-displays-uids-on-keys-that-have https://bitbucket.org/skskeyserver/sks-keyserver/issues/41/w...