4 ms·

Some people don't sign their commits before pushing to a branch? Insane. (Reading docs...) The desktop client explicitly does not support this, why is that?

czbond 6y ago
Tesla did not (a few years back if I recall). If I had to swing, I'd say 98% of companies do not. Git does not make it trivial to impersonate commits. http://www.linuxjournal.com/content/signing-git-commits http://www.linuxjournal.com/content/signing-git-commits
- jfrunyon 6y ago
  What? Git absolutely makes it trivial to impersonate commits. All you have to do is change some Git config settings. Or, export your commit into a patch/email file (git format-patch), modify it, and then import it (git am). Or, set some environment variables (GIT_COMMITTER_NAME and GIT_COMMITTER_EMAIL). etc. As you yourself mentioned, very, very, very few projects/people sign their commits. Even fewer actually verify them.
  - czbond 6y ago
    Sign with GPG for the hash, as linked. The methods you mentioned do allow malicious modification. Signing the commit with a public key makes it a lot more difficult. In the same vein, one can spoof email - but DKIM, SPF, DMARC together as controls make it much more difficult.
    - jfrunyon 6y ago
      Again, as you yourself mentioned, very, very, very few projects/people sign their commits. Even fewer actually verify them. That has nothing to do with how easy Git makes it to impersonate commits. In fact, whether you sign or not, you can still easily impersonate commits with any Git tool unless the person on the other end actively verifies the signature. (Which GitHub makes much easier than git, since they also maintain & automatically check a verified mapping of email -> GPG key, instead of you having to somehow get the key and then make sure it's the right one and then explicitly tell git to verify the signature) I am well aware that you can sign commits with Git. I do, personally and professionally, and my coworkers and I are required to, by policy that I wrote. That has absolutely no bearing on the topic at hand even tangentially.
- slimsag 6y ago
  See this[0] for an example of just how bad GitHub's UI is at presenting impersonated commits. [0] https://news.ycombinator.com/item?id=24977398 https://news.ycombinator.com/item?id=24977398
  - jfrunyon 6y ago
    Their UI is far better at it than the git tool itself. You have to explicitly tell git to check signatures (not to mention needing to go get people's keys and verify that they're correct, which GitHub does for you).
    - slimsag 6y ago
      While that is true, I'm not sure anybody could be successful at a phishing attack carried out through the git CLI.
thebeardisred 6y ago
Commits? No. Tags? Yes.

czbond 6y ago

Tesla did not (a few years back if I recall). If I had to swing, I'd say 98% of companies do not. Git does not make it trivial to impersonate commits. http://www.linuxjournal.com/content/signing-git-commits http://www.linuxjournal.com/content/signing-git-commits

jfrunyon 6y ago
What? Git absolutely makes it trivial to impersonate commits. All you have to do is change some Git config settings. Or, export your commit into a patch/email file (git format-patch), modify it, and then import it (git am). Or, set some environment variables (GIT_COMMITTER_NAME and GIT_COMMITTER_EMAIL). etc. As you yourself mentioned, very, very, very few projects/people sign their commits. Even fewer actually verify them.
- czbond 6y ago
  Sign with GPG for the hash, as linked. The methods you mentioned do allow malicious modification. Signing the commit with a public key makes it a lot more difficult. In the same vein, one can spoof email - but DKIM, SPF, DMARC together as controls make it much more difficult.
  - jfrunyon 6y ago
    Again, as you yourself mentioned, very, very, very few projects/people sign their commits. Even fewer actually verify them. That has nothing to do with how easy Git makes it to impersonate commits. In fact, whether you sign or not, you can still easily impersonate commits with any Git tool unless the person on the other end actively verifies the signature. (Which GitHub makes much easier than git, since they also maintain & automatically check a verified mapping of email -> GPG key, instead of you having to somehow get the key and then make sure it's the right one and then explicitly tell git to verify the signature) I am well aware that you can sign commits with Git. I do, personally and professionally, and my coworkers and I are required to, by policy that I wrote. That has absolutely no bearing on the topic at hand even tangentially.
slimsag 6y ago
See this[0] for an example of just how bad GitHub's UI is at presenting impersonated commits. [0] https://news.ycombinator.com/item?id=24977398 https://news.ycombinator.com/item?id=24977398
- jfrunyon 6y ago
  Their UI is far better at it than the git tool itself. You have to explicitly tell git to check signatures (not to mention needing to go get people's keys and verify that they're correct, which GitHub does for you).
  - slimsag 6y ago
    While that is true, I'm not sure anybody could be successful at a phishing attack carried out through the git CLI.

thebeardisred 6y ago

Commits? No. Tags? Yes.