4 ms·
> who has contributed over time When major security players insist that using GPG is bad, there is no way of knowing if bob@bob.bob is the same account that it
by guappa 2y ago
> who has contributed over time
When major security players insist that using GPG is bad, there is no way of knowing if bob@bob.bob is the same account that it was last month or not.
- StrauXX 2y agoIt is not the idea of GPG thats bad. In fact, the idea is great! The implementation of GPG however is quite another thing. Ease of use and user experience are really not that great with GPG. It is difficult to use even for developers. Developers are users too amd so on.
- guappa 2y agoTry uploading a signed package on pypi. Sign it with sequoia instead of GPG if you like. You'll receive an email asking you to stop uploading signatures.
- arccy 2y agoyou can sell/steal keys just as easily as accounts
- guappa 2y agoOk. Can you get my private key? Feel free to respond to this comment with my private GPG key. I think guessing a password and getting lucky is much easier.