3 ms·
You're saying the presence of PGP-signed commits is correlated with programmer skill? I have never signed my commits because I see absolutely no reason to (my
by arjvik 5y ago
You're saying the presence of PGP-signed commits is correlated with programmer skill?
I have never signed my commits because I see absolutely no reason to (my repositories are all small personal projects that nobody uses), and I haven't gotten around to setting up a proper key management workflow with my password manager. Maybe I need to start signing them!
- 0des 5y agoI sign mine because though I do not wish to be contacted, I want to be able to verify that what I published came from the online identity I am using at that time for that project. I don't share keys, I don't want to be contacted, I also don't want to be impersonated, which is easy in Git
- ttyprintk 5y agoVery good point: the best reason to sign is to prevent impersonation. This design decision in git is widespread among other commercial implementations, like Microsoft TFS.
- encryptluks2 5y agoYou can create a key specifically for GitHub and use your no-reply address on the key. That is what I do.
- ttyprintk 5y agoI guess I’m willing to accept emails out of the blue to my GitHub address, so long as they’re encrypted. Must be annoying to some people, but I’ll never know.
- ttyprintk 5y agoLet’s forget the word “correlated”. Commits might be signed because an organization expects it, and the kinds of projects with that policy might be rather serious (as opposed to frivolous), and serious projects might have rather senior devs. I’m not saying anything about the type I error, just type II error.