4 ms·
I don't consider "verified" in the GitHub UI as safe to rely on. If you forge a commit from Linus Torvalds, where Joe Blow is the co-author, as long as Joe Blo
by slimsag 4y ago
I don't consider "verified" in the GitHub UI as safe to rely on.
If you forge a commit from Linus Torvalds, where Joe Blow is the co-author, as long as Joe Blow GPG signed the commit it will show "Verified" with no distinction indicating Linus did not.
This combined with other issues I reported to GitHub like this[0] ('working as intended', but now thankfully fixed because it blew up on Twitter months later) makes me think GitHub doesn't care to invest a whole lot in commit verification stuff.
[0] https://news.ycombinator.com/item?id=24977398 https://news.ycombinator.com/item?id=24977398
- password4321 4y agoI agree that GitHub "verified" does seem to be mostly for show right now, thanks for emphasizing that. My point was more that the show (which many would consider using it for) isn't even working yet for this project.
- everfrustrated 4y agoGitHub will only let you add a GPG key if you have verified your email address. So, yes you can of course have Verified name spoofing, but at least the email in git commits can be trusted.