3 ms·

If I may plug my own app, EasyGit is a third alternative for macOS users. It pushes git repos to iCloud. https://easygit.app https://easygit.app

Scarbutt 7y ago
I think the key context here is "encryption" which your app doesn't have.
- verigit 7y ago
  EasyGit data are encrypted by Apple. So it is on par with using KeyBase or GitHub. I give you that it is not the same as rolling your own crypto, but I was replying to a comment about KeyBase.
  - Scarbutt 7y ago
    Don't know anything about keybase, can keybase see the data in your encrypted git repos?
    - noodlesUK 7y ago
      No, they are end to end encrypted. https://keybase.io/blog/encrypted-git-for-everyone https://keybase.io/blog/encrypted-git-for-everyone
  - iknowstuff 7y ago
    Wow, sir, you are presenting yourself as a little bit clueless. Keybase's whole shtick is thorough end-to-end encryption on all of their products. They're not "rolling their own crypto". They use established, proven cryptography to share keys between your devices without ever having access to your private keys themselves. Apple, on the other hand, can see everything you upload to iCloud Drive, iCloud Photos etc. Don't believe their marketing, they only do e2e on the Keychain and Messages - and even then the clients have no way of making sure the recipient's key they received from Apple actually matches their private key. So Apple could fool both sides, give them keys generated by Apple and decrypt everything on their servers when requested by authorities like fucking China (a.k.a. MITM).
    - verigit 7y ago
      Sorry, I was referring to the S3+GPG solution. However as far as I know the Keybase client is closed source, so everything you say also applies to them.
      - iknowstuff 7y ago
        The keybase client is open source: https://github.com/keybase/client https://github.com/keybase/client
      - calculuscrayon 7y ago
        GPG is designed to be used by end users. It's a bit cumbersome, but you don't have to implement any algorithms, which is what I assume is meant by 'rolling your own crypto'.
    - MertsA 7y ago
      That E2E encryption sure must be easy when you just handwave away key distribution. At least that's still not as bad as when FileVault discarded the user's password hint and instead used the plaintext password itself as the hint.

Scarbutt 7y ago

I think the key context here is "encryption" which your app doesn't have.

verigit 7y ago
EasyGit data are encrypted by Apple. So it is on par with using KeyBase or GitHub. I give you that it is not the same as rolling your own crypto, but I was replying to a comment about KeyBase.
- Scarbutt 7y ago
  Don't know anything about keybase, can keybase see the data in your encrypted git repos?
  - noodlesUK 7y ago
    No, they are end to end encrypted. https://keybase.io/blog/encrypted-git-for-everyone https://keybase.io/blog/encrypted-git-for-everyone
- iknowstuff 7y ago
  Wow, sir, you are presenting yourself as a little bit clueless. Keybase's whole shtick is thorough end-to-end encryption on all of their products. They're not "rolling their own crypto". They use established, proven cryptography to share keys between your devices without ever having access to your private keys themselves. Apple, on the other hand, can see everything you upload to iCloud Drive, iCloud Photos etc. Don't believe their marketing, they only do e2e on the Keychain and Messages - and even then the clients have no way of making sure the recipient's key they received from Apple actually matches their private key. So Apple could fool both sides, give them keys generated by Apple and decrypt everything on their servers when requested by authorities like fucking China (a.k.a. MITM).
  - verigit 7y ago
    Sorry, I was referring to the S3+GPG solution. However as far as I know the Keybase client is closed source, so everything you say also applies to them.
    - iknowstuff 7y ago
      The keybase client is open source: https://github.com/keybase/client https://github.com/keybase/client
    - calculuscrayon 7y ago
      GPG is designed to be used by end users. It's a bit cumbersome, but you don't have to implement any algorithms, which is what I assume is meant by 'rolling your own crypto'.
  - MertsA 7y ago
    That E2E encryption sure must be easy when you just handwave away key distribution. At least that's still not as bad as when FileVault discarded the user's password hint and instead used the plaintext password itself as the hint.