6 ms·

If signing commits becomes popular, it would be one of the very first tiny cracks in the stronghold of bigtech over the internet. So far, we trust GitHub that

If signing commits becomes popular, it would be one of the very first tiny cracks in the stronghold of bigtech over the internet. So far, we trust GitHub that a certain repo is under control of a certain individual or organization. We trust Twitter that a tweet was done by Elon Musk and not by Joe Doe. We trust Instagram, that Sue really got a like from that famous influencer and did not fake it. We trust HN, that I wrote this comment. But if signing these things would become the norm, commits, tweets, likes and posts would become eternal. Independent of any central authorities. Unfortunately, it will probably not become popular. As there is nothing to gain for the author of a commit by signing it.

wyldfire 4y ago
> As there is nothing to gain for the author of a commit by signing it. All of the recent focus on supply chain security could result in signed commits becoming more routine.
- echohack5 4y ago
  Do auditors care? All the ones I've dealt with just want you to log everything and rake your face over the hot pavement for their stamp of approval, actual security be damned. I'm surprised they even require 2FA at all.
  - fmajid 4y ago
    Useless security theater at best. They treat all 2FA as the same, including phishable TOTP or RSA SecurID, and (shudder) SMS.
    - staticassertion 4y ago
      Our auditors were perfectly willing to treat FIDO2 2FA as a specific mitigation against phishable credentials and whatnot. Really depends on your auditor/ the case you make.
      - fmajid 4y ago
        My point is the other methods should not be considered acceptable as 2FA because they are phishable. But yes, I'm sure there are competent auditors (as opposed to the ones who are financial auditors from accounting firms and completely out of their depth in matters of security). The problem is that unless there is a big stick, like a cybersecurity insurance company saying "unless you use U2F keys for 2FA, you are not covered", there is no incentive to change.
echohack5 4y ago
> Unfortunately it will not become popular because Twitter will not force celebrities to use SSH keysigning to earn a blue checkmark I mean, if you heard the horror stories of how a particular ex President's twitter password was incredibly insecure without even two factor auth you'd understand that users just don't care about anything even close to security. I still long for the old days of tech when you at least had to figure out how a 56K modem worked to use it. You at least had to respect the ancient wizardry or incur the wrath of the Code Gods. The amount of people using 1Password / Elliptical Curve Encryption / MFA in 2022 is effectively zero because everything has be ultra optimized for ease of use.
paulirwin 4y ago
GitHub has supported GPG-signed commits since 2016: https://github.blog/2016-04-05-gpg-signature-verification/ https://github.blog/2016-04-05-gpg-signature-verification/ AFAICT, the new thing here is that you can use SSH instead of GPG to sign commits, which should hopefully make it easier for people to adopt.
- chrisweekly 4y ago
  Yeah; GitLab has supported GPG-signed commits for years, too.
fariszr 4y ago
Personally I'm still dependent on the platforms, because I use the no-reply email supplied by the git platform. It helps avoiding spam, as its only used for just confirming the author.
remram 4y ago
It goes further than that. Knowing that leftpad 1.0 was indeed signed by johndoe1234, author of leftpad, does not help you in trusting that leftpad actually left pad strings correctly, that it doesn't do anything malicious, that vulnerabilities get patched, etc. In other words, it does nothing at all for you. Sure, you might trust Facebook, and so knowing that React 18.0 was indeed signed by Facebook is interesting. But then React depends on leftpad, is-odd, reversearray, ... by random devs. What security do you gain by verifying the random signatures from random devs? Unless there is a way for Facebook to sign those transitive dependencies, vouching for them in a way that you can check. That would be something. But their authors signing them does nothing.
staticassertion 4y ago
Commits are still signed with sha1, albeit a version that is resistant to the current attack against sha1. It kinda sucks, I'd be a lot more willing to sign commits (well, I do, but still) if it were at least backed by crypto that doesn't have decades of issues.

wyldfire 4y ago

> As there is nothing to gain for the author of a commit by signing it. All of the recent focus on supply chain security could result in signed commits becoming more routine.

echohack5 4y ago
Do auditors care? All the ones I've dealt with just want you to log everything and rake your face over the hot pavement for their stamp of approval, actual security be damned. I'm surprised they even require 2FA at all.
- fmajid 4y ago
  Useless security theater at best. They treat all 2FA as the same, including phishable TOTP or RSA SecurID, and (shudder) SMS.
  - staticassertion 4y ago
    Our auditors were perfectly willing to treat FIDO2 2FA as a specific mitigation against phishable credentials and whatnot. Really depends on your auditor/ the case you make.
    - fmajid 4y ago
      My point is the other methods should not be considered acceptable as 2FA because they are phishable. But yes, I'm sure there are competent auditors (as opposed to the ones who are financial auditors from accounting firms and completely out of their depth in matters of security). The problem is that unless there is a big stick, like a cybersecurity insurance company saying "unless you use U2F keys for 2FA, you are not covered", there is no incentive to change.

echohack5 4y ago

> Unfortunately it will not become popular because Twitter will not force celebrities to use SSH keysigning to earn a blue checkmark I mean, if you heard the horror stories of how a particular ex President's twitter password was incredibly insecure without even two factor auth you'd understand that users just don't care about anything even close to security. I still long for the old days of tech when you at least had to figure out how a 56K modem worked to use it. You at least had to respect the ancient wizardry or incur the wrath of the Code Gods. The amount of people using 1Password / Elliptical Curve Encryption / MFA in 2022 is effectively zero because everything has be ultra optimized for ease of use.

paulirwin 4y ago

GitHub has supported GPG-signed commits since 2016: https://github.blog/2016-04-05-gpg-signature-verification/ https://github.blog/2016-04-05-gpg-signature-verification/ AFAICT, the new thing here is that you can use SSH instead of GPG to sign commits, which should hopefully make it easier for people to adopt.

chrisweekly 4y ago
Yeah; GitLab has supported GPG-signed commits for years, too.

fariszr 4y ago

Personally I'm still dependent on the platforms, because I use the no-reply email supplied by the git platform. It helps avoiding spam, as its only used for just confirming the author.

remram 4y ago

It goes further than that. Knowing that leftpad 1.0 was indeed signed by johndoe1234, author of leftpad, does not help you in trusting that leftpad actually left pad strings correctly, that it doesn't do anything malicious, that vulnerabilities get patched, etc. In other words, it does nothing at all for you. Sure, you might trust Facebook, and so knowing that React 18.0 was indeed signed by Facebook is interesting. But then React depends on leftpad, is-odd, reversearray, ... by random devs. What security do you gain by verifying the random signatures from random devs? Unless there is a way for Facebook to sign those transitive dependencies, vouching for them in a way that you can check. That would be something. But their authors signing them does nothing.

staticassertion 4y ago

Commits are still signed with sha1, albeit a version that is resistant to the current attack against sha1. It kinda sucks, I'd be a lot more willing to sign commits (well, I do, but still) if it were at least backed by crypto that doesn't have decades of issues.